fix: redact auto-answer caller logs

[Justinabox]

Summary

• Redact the caller ID in run_server()'s auto-answer greeting INFO log via the existing redact_phone_number() helper.
• Add a deterministic fake-modem regression that exercises the registered call handler and verifies the raw identifier and sensitive prefix/middle fragments never reach logs while the masked suffix and greeting signal remain.

Closes #61 (one narrowly scoped log path).

Verification

• PYTHONPATH=. uv run --no-project --with pytest --with pytest-asyncio --with pytest-aiohttp --with pyserial-asyncio --with aiosqlite pytest tests/test_server_call_logging.py::test_incoming_call_log_masks_raw_caller_id -q — passed
• git diff --check — passed
• PYTHONPATH=. uv run --no-project --with pytest --with pytest-asyncio --with pytest-aiohttp --with pyserial-asyncio --with aiosqlite pytest tests/ -q — 992 passed

Risk

Low: changes only the rendered INFO-log value in the server auto-answer handler; call playback and hangup flow are covered by the fake-session regression.

[Justinabox]

Release review: needs-fix (preferred canonical fix for this log path). redact_phone_number() intentionally leaves non-empty values with no digits unchanged, while caller IDs are untrusted and can be non-numeric. Please make the auto-answer logging boundary fail closed for non-numeric caller IDs and add an end-to-end fake-modem/session caplog regression proving a non-numeric sentinel never appears. Keep the existing numeric mask test. Rebase on current main, run git diff --check, focused tests, and the required full pytest gate before re-review.

[Justinabox]

Release review: needs-fix (privacy blocker), so this is not ready to land.

redact_phone_number() leaves non-empty identifiers with no digits unchanged. Parser-reachable modem caller IDs are not guaranteed numeric, so a nonnumeric +CLIP value can still be written in full to this new INFO log. The test covers only a numeric session value.

Please use a fail-closed caller-log representation (or a sanitizer that also masks nonnumeric values), then add a parser/session-reachable nonnumeric caller-ID caplog regression. Rebase, run the full required suite, and request a fresh privacy review.

[Justinabox]

Release-lane classification: needs fix/revalidation before merge.

This draft was not independently reviewed or integration-tested in this pass and its GitHub mergeability is stale/unknown after current-main advances. Please rebase or otherwise validate it against current main, run the required full local gate, and request a fresh release review with exact head SHA and gate evidence. Do not treat absence of hosted checks as approval.

[Justinabox]

Release classification: needs-fix for this release pass.

The draft has not received a current exact-head review and prescribed local integration gate over the advancing main baseline. Rebase/repackage as needed against current main, resolve any conflicts, then provide a narrow behavioral review plus passing git diff --check and the prescribed full test suite before it can be reconsidered for landing.

[Justinabox]

Release review: needs-fix. The auto-answer log uses redact_phone_number(), which preserves nonempty values with no digits. A modem-controlled alphanumeric caller ID can therefore be logged verbatim. Add a runtime-handler test with a no-digit sentinel, use a fail-closed caller-ID log value, rebase on current origin/main, and rerun required gates.