fix(security): close moodLog SSRF, central error redaction, citation-drift fixes

[MBombeck]

Summary

Z-final.1 audit pass (security + truthfulness + performance + test theatre + i18n) turned up:

• 1 CRITICAL (moodLog SSRF — exploitable cloud-metadata leak)
• 2 HIGH (Telegram bot token leaking via Glitchtip; idempotency replay race)
• 4 truthfulness drift items (ESC/ESH year, steps source mislabel, Saint-Maurice plateau)
• 3 P0 performance items, 5 medium security, 7 low nits, 5 test-theatre minors

This PR fixes everything that's safe to land in a v1.4.1 hardening release. The deeper architectural items (idempotency transactional rewrite, encryption-key NODE_ENV fallback, refresh-token reuse-detection serialisation, moodLog HMAC lookup column, recharts dynamic split for /insights, MoodEntry index migration, glucose-history bound) are tracked for v1.4.2 in a separate followup-issues doc that will land alongside this PR.

What changes

CRITICAL — moodLog SSRF

• src/lib/validations/moodlog.ts refines the credentials URL with isPublicUrl() so an authenticated user cannot store http://169.254.169.254/ or RFC1918 hosts.
• src/lib/moodlog/sync.ts re-checks isPublicUrl(baseUrl) at the fetch site (legacy rows stored before the guard are also refused) and switches to redirect: "manual" + treat 3xx as failure.
• New unit suite src/lib/validations/__tests__/moodlog.test.ts asserts rejection of 169.254.x.x, 10.x, 172.16.x.x, 192.168.x.x, 127.0.0.1, and localhost.

HIGH — error-message secret leakage

• src/lib/logging/redact.ts (new) — central redactor for Bearer …, Telegram bot<digits>:<token> URLs, and query-string secrets (?secret=, ?code=, ?token=, ?api_key=).
• WideEventBuilder.setError() now scrubs err.message and err.stack before they reach Loki.
• reportToGlitchtip() now scrubs the same fields before they reach the incident UI (defence in depth — different code path, same risk).
• New unit suite src/lib/logging/__tests__/redact.test.ts covers the four patterns and the deliberate over-redaction trade-off (Bearer \S+ greedily consumes — safe).

Truthfulness drift (audit found 0 hallucinations, 4 drift)

• messages/{en,de}.json bpClassificationTitle and avg30dEsc: ESC/ESH 2018 → ESH 2023 (user-visible on the dashboard + doctor-report PDF).
• src/lib/analytics/classifications.ts: section header, getBpTargetsByAge() docblock, and the 65+ comment all updated to ESH 2023 with the "numerically unchanged from joint 2018" caveat.
• src/app/api/insights/targets/route.ts:375: steps target source: "WHO" → "Saint-Maurice JAMA 2020". AI-prompt anti-pattern guard already forbade WHO; this surface was the last drift.
• Saint-Maurice "mortality plateau 8000-12000" attribution softened to "continued dose-response benefit through ~12,000 steps/day, not a plateau" everywhere it appears (medical-citations.ts, effective-range.ts, classifications.ts, both AI prompts). The original JAMA 2020 paper shows continuing benefit (HR 0.49 at 8k vs 4k, HR 0.35 at 12k); the plateau-shaped finding belongs to Paluch 2022 Lancet Public Health, not Saint-Maurice.

Quality gates

• pnpm typecheck clean
• pnpm test — 669 / 669 pass (was 658; +11 from new suites)
• pnpm test:integration — 10 / 10 (untouched)
• pnpm lint — 0 errors

Audit reports

The full audit findings live under ~/infra/reports/v14-{security,truthfulness,performance,test-theatre,i18n-drift}-audit.md. The followup-issues file with the items deferred to v1.4.2 will be written alongside this PR's merge.

🤖 Generated with Claude Code