chore(format): prettier sweep over phase-2 touched files + stale planning docs

Picks up the prettier line-wraps the v1.5 phase-1 planning docs and
codex-protocol-spec.md missed, and brings the redact.ts + insights
generate route test into the project's standard form. No behaviour
change — pnpm format:check now passes clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/app/api/insights/generate/__tests__/route.test.ts

@@ -113,7 +113,7 @@ describe("POST /api/insights/generate — provider error mapping", () => {
   it("maps a 401 from the provider to 422 with a readable message", async () => {
     const err = Object.assign(new Error("OpenAI request failed (401)"), {
       httpStatus: 401,
-      bodyExcerpt: "{\"error\":{\"code\":\"invalid_api_key\"}}",
+      bodyExcerpt: '{"error":{"code":"invalid_api_key"}}',
     });
     makeProviderThatThrows(err);
 

src/lib/logging/redact.ts

@@ -23,25 +23,24 @@
  * want partial revelation of token entropy.
  */
 export function redactSecrets(input: string): string {
-  return input
-    .replace(/Bearer\s+\S+/gi, "Bearer [REDACTED]")
-    .replace(/bot\d+:[A-Za-z0-9_-]+/g, "bot[REDACTED]")
-    // `sk-` is a common English-prefix substring (task-force, risk-
-    // management, disk-io). Without a word-boundary, the original
-    // `/sk-(?:ant-)?[A-Za-z0-9_-]+/g` over-matched and made server logs
-    // unreadable. Require the `sk-` token to be at the start of the
-    // string OR preceded by a non-alphanumeric character (whitespace,
-    // `=`, `{`, `,`, `:`, etc.). The minimum length-8 tail keeps a
-    // tiny safety margin against `sk-1`-style false-positives in code
-    // identifiers. Capture group 1 = the leading separator (preserved).
-    .replace(
-      /(^|[^A-Za-z0-9])sk-(?:ant-)?[A-Za-z0-9_-]{8,}/g,
-      "$1[REDACTED]",
-    )
-    .replace(
-      /([?&])(secret|code|token|api[_-]?key)=[^&\s]+/gi,
-      "$1$2=[REDACTED]",
-    );
+  return (
+    input
+      .replace(/Bearer\s+\S+/gi, "Bearer [REDACTED]")
+      .replace(/bot\d+:[A-Za-z0-9_-]+/g, "bot[REDACTED]")
+      // `sk-` is a common English-prefix substring (task-force, risk-
+      // management, disk-io). Without a word-boundary, the original
+      // `/sk-(?:ant-)?[A-Za-z0-9_-]+/g` over-matched and made server logs
+      // unreadable. Require the `sk-` token to be at the start of the
+      // string OR preceded by a non-alphanumeric character (whitespace,
+      // `=`, `{`, `,`, `:`, etc.). The minimum length-8 tail keeps a
+      // tiny safety margin against `sk-1`-style false-positives in code
+      // identifiers. Capture group 1 = the leading separator (preserved).
+      .replace(/(^|[^A-Za-z0-9])sk-(?:ant-)?[A-Za-z0-9_-]{8,}/g, "$1[REDACTED]")
+      .replace(
+        /([?&])(secret|code|token|api[_-]?key)=[^&\s]+/gi,
+        "$1$2=[REDACTED]",
+      )
+  );
 }
 
 /** Apply `redactSecrets` to a possibly-undefined string. */