sec: startup secret validation and centralized log redaction

[Dami24-hub]

Summary of Changes

1. Startup Secret Validation Check (Add Secret Configuration Startup Check #692):

   • Implemented validateSecrets() in listener/src/config/validate-secrets.ts to enforce required secret availability on startup.
   • Added placeholder detection via KNOWN_PLACEHOLDERS list, rejecting development sentinel values (e.g. changeme, secret, 123456, whsec_your_secret_here) in production mode (NODE_ENV === "production").
   • Ensured startup failure messages detail field names and remediation guidance without printing secret values.
   • Wired validateSecrets() into validateConfig() in listener/src/config.ts so it runs at bootstrap after structural checks.
   • Updated listener/src/index.ts to specifically catch and log SecretValidationError with field-level diagnostics only.

2. Centralized Log Redaction Policy (Add Sensitive Field Redaction to Logs #691):

   • Created listener/src/utils/redact.ts with a centralized SENSITIVE_KEYS list, isSensitiveKey(), redactString(), redactValue(), and redactObject() functions.
   • Covers: password, token, apiKey, secret, authorization, webhookUrl, privateKey, hmac, jwt, cookie, sessionId, and all common variants.
   • Also redacts URL-embedded credentials (user:pass@host) and Bearer/Token auth header patterns in string values.
   • Integrated redaction into listener/src/utils/logger.ts's formatMeta() function so all structured log messages, context objects, and error stack trace metadata pass through redaction before writing to stdout/stderr or log files.
   • All log levels (debug, info, warn, error) share the same pipeline.
   • Added unit tests in listener/src/utils/redact.test.ts verifying that representative secrets, token strings, and auth headers are completely masked to [REDACTED].

Issue Resolution

Closes #691
Closes #692

Verification

• Startup validator checks missing and placeholder secrets without printing raw values
• Redaction policy applied consistently across standard and error logs
• Redaction unit tests created covering isSensitiveKey, redactString, redactValue, redactObject, and representative secrets
• Verification execution steps skipped per prompt instructions

[drips-wave]

@Dami24-hub Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits