chore(observability): add headerValue to the redact denylist

The webhook shared secret lives only inside the AES-GCM-encrypted channel
config blob and the GET masks it, so no current path excerpts it into a
wide event. Add headervalue to the sensitive-key denylist as defence in
depth: if a future change ever routes a webhook body through the payload
diagnostic, the secret redacts instead of landing verbatim. The Live
Activity push token is already covered by the token pattern.

src/lib/observability/__tests__/redact-payload.test.ts

@@ -163,4 +163,18 @@ describe("redactSensitiveFields", () => {
       benignField: "kept",
     });
   });
+
+  it("redacts the webhook shared secret (headerValue) and the Live Activity token", () => {
+    const body = {
+      headerValue: "super-secret-webhook-key",
+      liveActivityPushToken: "abc123",
+      webhookUrl: "https://example.com/hook",
+    };
+    expect(redactSensitiveFields(body)).toEqual({
+      headerValue: "[redacted]",
+      // Covered by the existing /token/i pattern.
+      liveActivityPushToken: "[redacted]",
+      webhookUrl: "https://example.com/hook",
+    });
+  });
 });

src/lib/observability/redact-payload.ts

@@ -65,6 +65,13 @@ export const SENSITIVE_KEY_PATTERNS: readonly RegExp[] = [
   /progesteronetest/i,
   /contraceptive/i,
   /cervicalmucus/i,
+  // v1.17.1 — the webhook shared secret. `headerValue` lives only inside the
+  // AES-GCM-encrypted `NotificationChannel.config` blob and the GET masks it
+  // to `hasHeaderValue`, so no current path excerpts it. Defence-in-depth: if
+  // a future change routes a webhook body through `buildPayloadDiagnostic`,
+  // the secret redacts instead of landing verbatim. The Live Activity push
+  // token is already covered by `/token/i`.
+  /headervalue/i,
 ];
 
 const REDACTED = "[redacted]";