fix(multiplayer): harden observability redaction

server/observability/log_test.go

@@ -2,6 +2,7 @@ package observability
 
 import (
 	"encoding/json"
+	"strings"
 	"testing"
 	"time"
 )
@@ -30,3 +31,20 @@ func TestEncodeRejectsUnnamedEvents(t *testing.T) {
 		t.Fatal("unnamed event accepted")
 	}
 }
+
+func TestEncodeRedactsCredentialLookingValuesUnderUnknownKeys(t *testing.T) {
+	payload, err := Encode(Event{Event: "test", Fields: map[string]any{
+		"unexpected": "workload-secret-value-12345678901234567890",
+		"nested":     map[string]string{"opaque": "Bearer should-not-appear"},
+		"items":      []string{"eyJhbGciOiJIUzI1NiJ9.payload-value.signature-value"},
+	}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	text := string(payload)
+	for _, secret := range []string{"workload-secret-value", "Bearer should-not-appear", "eyJhbGciOiJIUzI1NiJ9"} {
+		if strings.Contains(text, secret) {
+			t.Fatalf("credential leaked under unknown key: %s", payload)
+		}
+	}
+}