test(audit): add deep redaction, cyclic-payload and large-string regression tests

[bamiebot-maker]

Summary

Closes #147

Adds comprehensive deep-redaction and cyclic-payload regression tests for core/audit/audit.ts and core/telemetry/telemetry.ts.

---

What was added

core/audit/__tests__/audit.deep-redaction.test.ts — 27 tests

auditContext (10 tests)

• Accepts primitives; drops non-primitives (objects, arrays) rather than serialising them
• Redacts sensitive keys (secret, token, password, key, auth, etc.) regardless of case (SECRET, Secret, sEcReT)
• Truncates string values to the 160-char limit
• Scrubs embedded Stellar secret seeds (S…) inside string values
• Caps context at AUDIT_MAX_CONTEXT_KEYS — excess keys are silently dropped
• Returns undefined for empty, undefined, or null input
• Always produces JSON-serializable output

Audit trail (4 tests)

• Stores a redacted context — no raw secrets appear in the persisted event
• Redacts case-variant sensitive keys in before/after
• Produces a fully JSON-serializable event

redact (telemetry) — deep nested structures (4 tests)

• Redacts sensitive keys at every nesting depth
• Redacts secrets inside nested arrays
• Scrubs embedded Stellar seeds from string values
• Returns [TRUNCATED_DEPTH] at MAX_REDACT_DEPTH — never infinitely recurses

redact — circular references (5 tests)

• Direct self-reference (obj.self = obj) → [CIRCULAR], no throw
• Multi-hop cycle (A→B→A) → [CIRCULAR] at the second occurrence
• Cyclic array (arr.push(arr)) → [CIRCULAR]
• Cyclic + sensitive keys — both handled correctly in one pass
• Result of circular redaction is always JSON-serializable

redact — large strings (3 tests)

• No throw on strings > MAX_SCANNABLE_STRING_LENGTH (500k chars)
• Truncates with [TRUNCATED] marker
• Still redacts secrets before the truncation point

Audit trail — serialization after redaction (2 tests)

• All events returned by .all() are JSON-serializable
• export({ format: "json" }) produces valid, parseable output

---

Tests run

27 passed, 0 failed