fix(core/http): filter sensitive data from logs and allow unauthenticated health checks

[joelrb]

Description

Problem

Two security-related issues found during code review:

1. Logger was outputting raw details without sanitization, potentially exposing API keys, passwords, and tokens in log files
2. Health check endpoints required authentication, preventing container orchestrators from probing service health

Fix Applied

1. Logger sensitive data filtering - Added filterSensitiveData() function that recursively filters sensitive keys from log details. Filters keys containing: api_key, password, secret, token, authorization, auth, private_key, and any key containing "password", "secret", or "token" (case-insensitive). Replaces with [REDACTED].

2. Public health endpoint - Added /health to PUBLIC_PATHS in security middleware, allowing unauthenticated access for container orchestration health checks. Added normalization to handle trailing slashes.

Framework Change
None

Files Changed

• controller/src/core/logger.ts
• controller/src/http/security-middleware.ts

Security Severity: Medium

• Prevents credential leakage in logs; enables proper health monitoring

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Refactoring (no functional changes)
• CI/CD changes
• Performance improvements

Related Issues

Fixes #
Related to #

Testing

Describe the testing performed for this PR:

• Unit tests pass
• Integration tests pass
• Manual testing performed
• All linting passes
• Type checking passes
• Dead code check passes

Include specific test scenarios or commands used.

Manual test:

Test 1: Logger filters sensitive data
Controller starts normally - API keys in logs now show as [REDACTED]

Test 2: Health endpoint allows unauthenticated access
curl http://localhost:8080/health
Returns 404 (no endpoint) instead of 401 (unauthorized)

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have tested my changes locally
• I have updated AGENTS.md if needed (for architectural changes)
• I have added appropriate labels (Priority, Type, Area)
• No new security vulnerabilities introduced

Performance & Security

• Performance impact considered (no significant regressions)
• Dependencies audited (no known vulnerabilities)
• Secrets not exposed
• Error handling implemented appropriately

Screenshots (if applicable)

Additional Notes

Logger filtering works recursively - nested objects in log details are also sanitized.

[0xSero]

Partial overlap with main now: the /health half already landed (PUBLIC_PATHS includes /health in http/security-middleware.ts since the security-hardening commits), so please drop that hunk on rebase. The logger redaction is still worth having — main's core/logger.ts does raw JSON.stringify(details) with no filtering. Asks for the update: hoist SENSITIVE_KEYS/filterSensitiveData to module scope (they're rebuilt per logger instance), restore the original indentation of shouldLog/format to keep the diff minimal, and fix the lint error (obj → object). With those, this is mergeable.

[0xSero]

Closing as superseded. The /health endpoint is already public on current main, so that half of this PR landed independently. The remaining logger-redaction intent is covered more comprehensively by #253, which handles structured and fragmented credential redaction across logs and streams, sensitive-file permissions, and focused regression coverage. Thank you for surfacing both problems; the useful security intent is preserved in the newer work.