fix(security): redact PII in /api/log before it reaches Vercel logs (audit E1) (#649)

The onboarding client-error endpoint logged untrusted client-supplied message + extra via raw console.error + JSON.stringify(extra) with NO redaction, leaking personnummer / IBAN / tokens into Vercel logs. Route through the structured logger (createLogger), whose REDACT_KEYS + redactString sanitize both the message and the nested extra payload before emit. Response contract unchanged ({ ok: true|false }).

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/api/log/route.ts

@@ -1,11 +1,18 @@
 import { NextResponse } from 'next/server'
+import { createLogger } from '@/lib/logger'
+
+const log = createLogger('onboarding-client')
 
 export async function POST(request: Request) {
   try {
     const { message, extra } = await request.json()
 
-    // This console.error runs server-side → visible in Vercel Logs
-    console.error('[onboarding]', message, extra ? JSON.stringify(extra) : '')
+    // Client-reported onboarding errors. Route through the structured logger so
+    // the (untrusted, client-supplied) message + extra are PII-redacted —
+    // personnummer / IBAN / tokens etc. via the logger's REDACT_KEYS — before
+    // reaching Vercel logs. The previous raw `console.error(..., JSON.stringify(extra))`
+    // logged them verbatim.
+    log.error('client onboarding error', { clientMessage: message, extra })
 
     return NextResponse.json({ ok: true })
   } catch {