fix(apirouter): keep destination credentials out of attempts and request logs

[alexluong]

Closes #1094.

include=destination on GET /attempts, GET /attempts/:id, and GET /tenants/:tenant_id/destinations/:destination_id/attempts now returns the destination without credentials. Credentials are only returned by the destination endpoints.

The request body logged on 5xx responses now redacts every credential value. Before, redaction depended on provider metadata, so webhook secrets (not marked sensitive) and PATCH bodies (no type to load metadata from) were logged in plaintext.

Breaking

Callers reading credentials from an embedded destination on attempts no longer get them. Use GET /tenants/:tenant_id/destinations/:destination_id.

Spec: open question

Every per-type Destination* schema requires credentials, so the embedded destination no longer matches Destination. Two options:

• A (this PR): a new AttemptDestination schema for attempt.destination. The Destination schema and destination endpoints are unchanged. Attempts lose per-type typing: config becomes a generic string map in the SDKs.
• B: make credentials optional in every Destination* schema. Attempts keep the typed per-type destination. Every SDK's Destination type changes; in Go, Credentials likely becomes a pointer, which breaks callers reading it from destination endpoints.

Going with A for now. Input welcome.

Tests

• TestAPI_Attempts: include=destination responses have no credentials key.
• TestRequestBodySanitizer_RedactsAllCredentials: a body without type still has its credentials redacted.

🤖 Generated with Claude Code