fix(security): redact Bearer tokens from server log output

Pino logged full Authorization headers in plaintext to server.log,
exposing JWT tokens to any process with filesystem read access.
Add redact paths so Bearer values appear as [Redacted] in log output.

Closes #2385

server/src/middleware/logger.ts

@@ -28,6 +28,7 @@ const sharedOpts = {
 
 export const logger = pino({
   level: "debug",
+  redact: ["req.headers.authorization", "req.headers[\"authorization\"]"],
 }, pino.transport({
   targets: [
     {