chore(logging): add logging quality audit

[suculent]

Summary

• Added a backend/API logging quality auditor with JSON output and an npm entrypoint.
• Added regression coverage for high-risk sensitive logging and tracked statistics-event quality gaps.
• Redacted websocket cookie headers, OAuth/GDPR handoff tokens, OAuth wrapper/hdata logs, and invalid-login username logging.
• Routed LOGIN_INVALID, BUILD_STARTED, BUILD_FAILED, BUILD_SUCCESS, DEVICE_CHECKIN, and DEVICE_NEW through warn-level logger coverage while preserving metrics calls.

Audit report

• Files scanned: 80
• console.* calls: 897
• logger.* calls: 20
• Tracked event occurrences: 26
• Sensitive findings: 21
• High-risk sensitive findings: 0
• Severity-string mismatches: 607
• Tracked event quality gaps: 0

Verification

• PASS: npm run logging-audit -- --json
• PASS: npm run --silent logging-audit -- --json
• PASS: ENVIRONMENT=development MAILGUN_API_KEY=test COUCHDB_USER=test COUCHDB_PASS=test npx jasmine --config=/tmp/thinx-jasmine-nohelpers.json spec/jasmine/LoggingQualityAuditSpec.js spec/jasmine/UtilSpec.js spec/jasmine/LoggerSpec.js spec/jasmine/MetricsCoverageSpec.js (47 specs, 0 failures)
• BLOCKED: npx jasmine spec/jasmine/LoggingQualityAuditSpec.js spec/jasmine/UtilSpec.js spec/jasmine/LoggerSpec.js spec/jasmine/MetricsCoverageSpec.js using the repo default helper. Bootstrap fails before these specs execute because ENVIRONMENT is unset; with development env it then fails on existing module-load issues (missing local env followed by uuid ESM require from lib/thinx/device.js).