fix: remove sensitive telemetry from logs and metrics

[niko-kriznik-globtim]

Summary

• Add a fail-closed zap field allowlist in internal/logger and route HTTP server errors through a safe ErrorLog.
• Restrict HTTP access logs to route/method/status/duration; remove payload, DevEUI, URL, IP, user-agent, request ID, and response logging.
• Write CLI JSON decode output to stdout instead of zap; sanitize AWS/LoRaCloud solver logging with bounded error categories.
• Remove devEui, base_url, and payload-derived TLV metric labels; add privacy canary tests.

Closes truvami/bridge#125

Test plan

• go test ./...
• Privacy canary tests in internal/logger, cmd, pkg/common, and pkg/solver
• Manual: run decoder http --health and confirm access logs omit query strings, DevEUI, and payloads
• Manual: run decoder tagsl 1 <payload> --json and confirm JSON is written to stdout only
• Manual: scrape /metrics and confirm LoRaCloud/AWS counters no longer expose device or URL labels

[niko-kriznik-globtim]

@coderabbitai review

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 931e4e85-8acb-4a60-b081-0902f1c559d5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.