chore(logging): add logging quality audit

[suculent]

Summary

• Added a backend/API logging quality auditor with JSON output and an npm entrypoint.
• Added regression coverage for high-risk sensitive logging and tracked statistics-event quality gaps.
• Redacted websocket cookie headers, OAuth/GDPR handoff tokens, OAuth wrapper/hdata logs, and invalid-login username logging.
• Routed LOGIN_INVALID, BUILD_STARTED, BUILD_FAILED, BUILD_SUCCESS, DEVICE_CHECKIN, and DEVICE_NEW through warn-level logger coverage while preserving metrics calls.

Audit report

• Files scanned: 80
• console.* calls: 897
• logger.* calls: 20
• Tracked event occurrences: 26
• Sensitive findings: 21
• High-risk sensitive findings: 0
• Severity-string mismatches: 607
• Tracked event quality gaps: 0

Verification

• PASS: npm run logging-audit -- --json
• PASS: npm run --silent logging-audit -- --json
• PASS: ENVIRONMENT=development MAILGUN_API_KEY=test COUCHDB_USER=test COUCHDB_PASS=test npx jasmine --config=/tmp/thinx-jasmine-nohelpers.json spec/jasmine/LoggingQualityAuditSpec.js spec/jasmine/UtilSpec.js spec/jasmine/LoggerSpec.js spec/jasmine/MetricsCoverageSpec.js (47 specs, 0 failures)
• BLOCKED: npx jasmine spec/jasmine/LoggingQualityAuditSpec.js spec/jasmine/UtilSpec.js spec/jasmine/LoggerSpec.js spec/jasmine/MetricsCoverageSpec.js using the repo default helper. Bootstrap fails before these specs execute because ENVIRONMENT is unset; with development env it then fails on existing module-load issues (missing local env followed by uuid ESM require from lib/thinx/device.js).

---

Update: bounded auth-module fix slice (audit.js, router.js, apikey.js)

A second, deliberately narrow remediation slice covers the auth-sensitive
modules the first pass left untouched. Log-only changes, no control-flow
changes.

• Severity mismatches → correct level
  • lib/thinx/audit.js: _buildRecord missing-message → console.warn;
    log() insertion failure and fetch() failure → console.error.
  • lib/router.js: host-header-mismatch and blacklist-check-failed → console.warn;
    failed API-key authentication → console.warn.
  • lib/thinx/apikey.js: save_apikeys set failure, circuit-breaker OPEN,
    key-generator errors, Redis-unavailable/get errors, revoke/list
    error paths → console.error.
• Secret/token leakage → redacted or removed
  • apikey.js no longer logs the full json_keys blob (cleartext keys + hashes)
    in create()/revoke(); the "saving first API key" debug line logs only the alias.
  • Attempted invalid API-key values in log_invalid_key() and key_in_keys()
    are redacted via Util.redactToken().

Stats-parser safety: none of these files emit the [OID:...] [EVENT] lines
consumed by statistics.js, so no logger.warn() level was changed or downgraded.

Verification (this slice)

• PASS: npm run lint — only the 3 pre-existing errors remain, all in files this
  slice never touched (lib/thinx/statistics.js ×2, spec/jasmine/ZZ-WebSocketLifecycleSpec.js).
• PASS: isolated UtilSpec + LoggingQualityAuditSpec (33 specs, 0 failures).
• Audit re-scan: severity-string mismatches 607 → 590; two cleartext-key debug logs removed.