feat: add privacy-safe structured logging

apps/api/tests/test_logging.py

@@ -0,0 +1,33 @@
+from __future__ import annotations
+
+import json
+import logging
+
+from app.logging_config import JsonFormatter, redact
+
+
+def test_json_formatter_whitelists_fields_and_redacts_secrets() -> None:
+    record = logging.LogRecord(
+        name="rf4.test", level=logging.INFO, pathname=__file__, lineno=1,
+        msg="authorization=Bearer-secret token=top-secret Bearer abc.def",
+        args=(), exc_info=None,
+    )
+    record.request_id = "safe-request-id"
+    record.method = "GET"
+    record.path = "/api/v1/activity"
+    record.player_name = "Must Not Leak"
+    payload = json.loads(JsonFormatter().format(record))
+    assert payload["request_id"] == "safe-request-id"
+    assert payload["method"] == "GET"
+    assert payload["path"] == "/api/v1/activity"
+    assert "player_name" not in payload
+    assert "top-secret" not in payload["message"]
+    assert "abc.def" not in payload["message"]
+    assert payload["message"].count("[REDACTED]") == 3
+
+
+def test_redact_covers_common_credential_forms() -> None:
+    cleaned = redact("password=hunter2 secret: swordfish Authorization: token-value")
+    assert "hunter2" not in cleaned
+    assert "swordfish" not in cleaned
+    assert "token-value" not in cleaned