fix(gateway): redact sensitive error log details

apps/aether-gateway/src/handlers/admin/auth/api_keys/mutation_routes.rs

@@ -253,7 +253,7 @@ pub(super) async fn build_admin_create_api_key_response(
             {
                 tracing::error!(
                     api_key_id = %created.api_key_id,
-                    error = ?error,
+                    error = %crate::error::redact_error_debug(&error),
                     "standalone API key wallet provisioning cleanup failed"
                 );
                 return Err(error);
@@ -266,7 +266,7 @@ pub(super) async fn build_admin_create_api_key_response(
             {
                 tracing::error!(
                     api_key_id = %created.api_key_id,
-                    error = ?cleanup_error,
+                    error = %crate::error::redact_error_debug(&cleanup_error),
                     "standalone API key wallet provisioning cleanup failed"
                 );
             }

apps/aether-gateway/src/handlers/admin/provider/oauth/dispatch/device/lease.rs

@@ -47,7 +47,7 @@ impl AdminProviderOAuthDevicePollLease {
             Err(error) => {
                 tracing::warn!(
                     lock_key = %lock_key,
-                    error = ?error,
+                    error = %crate::error::redact_error_detail(&error),
                     "gateway provider OAuth device poll lease acquisition failed"
                 );
                 AdminProviderOAuthDevicePollLeaseAcquire::Unavailable
@@ -87,7 +87,7 @@ impl AdminProviderOAuthDevicePollLease {
             Err(error) => {
                 tracing::error!(
                     lock_key = %lease.key,
-                    error = ?error,
+                    error = %crate::error::redact_error_detail(&error),
                     "gateway provider OAuth device poll final lease renewal failed"
                 );
                 Err(AdminProviderOAuthDevicePollLeaseFailure::Unavailable)
@@ -106,7 +106,7 @@ impl AdminProviderOAuthDevicePollLease {
             Err(error) => {
                 tracing::warn!(
                     lock_key = %lease.key,
-                    error = ?error,
+                    error = %crate::error::redact_error_detail(&error),
                     "gateway provider OAuth device poll lease release failed"
                 );
                 // Keep the lease in the guard so Drop can make one best-effort retry.
@@ -128,7 +128,7 @@ impl Drop for AdminProviderOAuthDevicePollLease {
             if let Err(error) = runtime.lock_release(&lease).await {
                 tracing::warn!(
                     lock_key = %lease.key,
-                    error = ?error,
+                    error = %crate::error::redact_error_detail(&error),
                     "gateway provider OAuth device poll lease Drop release failed"
                 );
             }

apps/aether-gateway/src/handlers/admin/system/management_tokens.rs

@@ -72,7 +72,7 @@ fn admin_management_token_internal_error_response(
     tracing::error!(
         event_name,
         trace_id,
-        error = ?error,
+        error = %crate::error::redact_error_debug(&error),
         "management token operation failed"
     );
     (

apps/aether-gateway/src/handlers/public/support/auth_registration.rs

@@ -360,7 +360,7 @@ pub(super) async fn handle_auth_send_verification_code(
     if let Err(err) = send_auth_email(state, smtp_config, email_message).await {
         tracing::warn!(
             event_name = "auth_verification_email_send_failed",
-            error = ?err,
+            error = %crate::error::redact_error_debug(&err),
             "failed to send authentication verification email"
         );
         let _ = clear_auth_email_pending_code(state, &email).await;
@@ -665,7 +665,7 @@ pub(super) async fn handle_auth_register(
             Err(err) => {
                 tracing::warn!(
                     event_name = "auth_email_registration_proof_consume_failed",
-                    error = ?err,
+                    error = %crate::error::redact_error_debug(&err),
                     "failed to consume email registration proof"
                 );
                 return build_auth_error_response(
@@ -931,7 +931,7 @@ pub(super) async fn handle_auth_verify_email(
         Err(err) => {
             tracing::warn!(
                 event_name = "auth_email_verification_consume_failed",
-                error = ?err,
+                error = %crate::error::redact_error_debug(&err),
                 "failed to consume email verification challenge"
             );
             false
@@ -944,7 +944,7 @@ pub(super) async fn handle_auth_verify_email(
             Err(err) => {
                 tracing::warn!(
                     event_name = "auth_registration_proof_store_failed",
-                    error = ?err,
+                    error = %crate::error::redact_error_debug(&err),
                     "failed to store email registration proof"
                 );
                 true

apps/aether-gateway/src/handlers/public/support/auth_turnstile.rs

@@ -222,28 +222,28 @@ async fn read_auth_turnstile_config(
         .read_system_config_json_value("turnstile_enabled")
         .await
         .map_err(|err| {
-            warn!(error = ?err, "turnstile enabled config lookup failed");
+            warn!(error = %crate::error::redact_error_debug(&err), "turnstile enabled config lookup failed");
             AuthTurnstileFailure::ServiceUnavailable("人机验证服务暂不可用，请稍后重试")
         })?;
     let site_key = state
         .read_system_config_json_value("turnstile_site_key")
         .await
         .map_err(|err| {
-            warn!(error = ?err, "turnstile site key config lookup failed");
+            warn!(error = %crate::error::redact_error_debug(&err), "turnstile site key config lookup failed");
             AuthTurnstileFailure::ServiceUnavailable("人机验证服务暂不可用，请稍后重试")
         })?;
     let secret_key = state
         .read_system_config_json_value("turnstile_secret_key")
         .await
         .map_err(|err| {
-            warn!(error = ?err, "turnstile secret key config lookup failed");
+            warn!(error = %crate::error::redact_error_debug(&err), "turnstile secret key config lookup failed");
             AuthTurnstileFailure::ServiceUnavailable("人机验证服务暂不可用，请稍后重试")
         })?;
     let allowed_hostnames = state
         .read_system_config_json_value("turnstile_allowed_hostnames")
         .await
         .map_err(|err| {
-            warn!(error = ?err, "turnstile hostname config lookup failed");
+            warn!(error = %crate::error::redact_error_debug(&err), "turnstile hostname config lookup failed");
             AuthTurnstileFailure::ServiceUnavailable("人机验证服务暂不可用，请稍后重试")
         })?;
 
@@ -252,7 +252,7 @@ async fn read_auth_turnstile_config(
             decrypt_or_migrate_system_config_secret(state, "turnstile_secret_key", value)
                 .await
                 .map_err(|error| {
-                    warn!(error = ?error, "turnstile secret key migration failed");
+                    warn!(error = %crate::error::redact_error_debug(&error), "turnstile secret key migration failed");
                     AuthTurnstileFailure::ServiceUnavailable("人机验证服务暂不可用，请稍后重试")
                 })?,
         ),