fix(request-logger): redact the x-goog-api-key header

[mattpocock]

Gemini sends its API key in the x-goog-api-key header. The request-logger REDACT set held only authorization, x-api-key and api-key, so a student running the logger against their own Gemini key got that key written in plain text into the Markdown log — a log the course asks them to read and share.

Changes

• Add x-goog-api-key to REDACT in request-logger/render.ts.
• Add a test in request-logger/render.test.ts that proves the value is replaced with [REDACTED].

Verification

pnpm vitest run request-logger — 145 tests pass.

Note for the maintainer

request-logger/render.ts is on main, not in the lesson stack. After this merges, move the 25-commit stack onto the new main:

git branch backup/live-run-through-pre-redact-$(date +%s)
git rebase --onto main <old-main-sha> live-run-through
git push --force-with-lease origin live-run-through

🤖 Generated with Claude Code