Log CLI auth token correlation fields

[jahooma]

Summary

• Add a SHA-256 auth-code hash prefix helper for safe log correlation without recording opaque login tokens.
• Log issued CLI auth token hash prefixes, token length, fingerprint prefix/length, URL origin, request forwarding headers, configured app URL, and environment in both Codebuff and Freebuff token issuance routes.
• Extend Freebuff invalid auth-code warnings with the auth-code hash prefix, trimmed length, opaque-token shape, and authenticated user id.

Validation

• bun test web/src/app/onboard/__tests__/helpers.test.ts freebuff/web/src/app/onboard/__tests__/helpers.test.ts web/src/app/api/auth/cli/code/__tests__/origin.test.ts freebuff/web/src/app/api/auth/cli/code/__tests__/origin.test.ts
• bunx prettier --check web/src/app/api/auth/cli/code/route.ts web/src/app/onboard/__tests__/helpers.test.ts web/src/app/onboard/_helpers.ts freebuff/web/src/app/api/auth/cli/code/route.ts freebuff/web/src/app/onboard/__tests__/helpers.test.ts freebuff/web/src/app/onboard/_helpers.ts freebuff/web/src/app/onboard/page.tsx
• bun run typecheck in web/
• bun run typecheck in freebuff/web/
• git diff --check