Redact secrets from logs and downgrade PII log levels

[ChristianPavilonis]

Summary

• Security fix: Secrets (proxy_secret, secret_key, handler passwords) were logged in plaintext at INFO/DEBUG level. Introduced a Redacted<T> wrapper that prints [REDACTED] in Debug/Display while preserving transparent serde and .expose() access.
• Privacy fix: PII (client IP, user-agent) and full request/response payloads were logged at INFO/DEBUG. Downgraded PII logs to debug! and payload logs to trace! so they no longer appear in production.
• Logger level: Changed production logger from Debug to Info to prevent verbose output in production by default.

Changes

File	Change
crates/common/src/redacted.rs	New Redacted<T> wrapper type with [REDACTED] Debug/Display, transparent serde, .expose(), and tests
crates/common/src/lib.rs	Added mod redacted
crates/common/src/settings.rs	Changed proxy_secret, secret_key, username, password, secret_store_id to Redacted<String>; updated validators
crates/common/build.rs	Added redacted module #[path] for build
crates/common/src/auth.rs	Use .expose() for credential comparison
crates/common/src/http_util.rs	Use .expose() for proxy_secret access
crates/common/src/settings_data.rs	Use .expose() for secret_key comparison
crates/common/src/request_signing/endpoints.rs	Use .expose() for secret_store_id
crates/common/src/synthetic.rs	Downgraded 5 PII log calls (client IP, user-agent, synthetic IDs) from info! to debug!
crates/common/src/integrations/prebid.rs	Downgraded payload logging from debug! to trace!
crates/common/src/integrations/aps.rs	Downgraded payload logging from debug! to trace!
crates/common/src/integrations/adserver_mock.rs	Downgraded payload logging from debug! to trace!
crates/fastly/src/main.rs	Logger level Debug → Info; settings log info! → debug!
AGENTS.md	Fixed incorrect tracing reference to log

Closes

Closes #404

Test plan

• cargo test --workspace
• cargo clippy --all-targets --all-features -- -D warnings
• cargo fmt --all -- --check
• JS tests: cd crates/js/lib && npx vitest run
• JS format: cd crates/js/lib && npm run format
• Docs format: cd docs && npm run format
• WASM build: cargo build --bin trusted-server-fastly --release --target wasm32-wasip1
• Manual testing via fastly compute serve

Checklist

• Changes follow CLAUDE.md conventions
• No unwrap() in production code — use expect("should ...")
• Uses log macros (not println!)
• New code has tests
• No secrets or credentials committed