fix(logs): mask sk-proj/sk-svcacct/sk-admin OpenAI keys (#1762)

## Bug

The log sanitizer's `openai_key` pattern is `\b(sk-[A-Za-z0-9]{20,})\b`,
which only matches the legacy OpenAI key format. Current keys are
`sk-proj-…`, `sk-svcacct-…` and `sk-admin-…`, with `_` and `-` in the
random suffix. The hyphen four characters in breaks the 20-alphanumeric
run, so these keys are never matched. In free text, with no `=`/`:`
before them for `high_entropy` to catch, they are logged in full.

The audit redactor (`internal/audit/redact.go`) and the security pattern
set (`patterns/tokens.go`) were already updated for these formats; the
log sanitizer was not.

## Trigger

```go
logger.Info("using key sk-proj-AbCdEf1234567890_GhIjKl-MnOpQrStUvWxYz0123456789 for upstream")
```

On main the key is written to the log unchanged.

## Fix

Extend the pattern with a `(proj|svcacct|admin)-` branch that allows `_`
and `-` in the suffix. The legacy branch stays alphanumeric, so
`sk-ant-…` keys still fall through to the more specific `anthropic_key`
pattern and keep its mask.

## Test

`TestSanitizer_OpenAIProjectAndServiceAccountKeys` checks that the
project, service-account, admin and legacy keys are all masked, and that
an `sk-ant-api03-…` key is still masked by `anthropic_key`
(`sk-ant-api***`).

## Commands run

- `CGO_ENABLED=0 go test -count=1 ./internal/logs`: ok
- With the fix reverted (`git stash` of `sanitizer.go`), the new test
fails for the `sk-proj-`, `sk-svcacct-` and `sk-admin-` keys with
`OpenAI key leaked`.
- `gofmt -l` on the edited files: no output

Author: rudycelekli

internal/logs/sanitizer.go

@@ -52,10 +52,12 @@ func (s *SecretSanitizer) registerDefaultPatterns() {
 		},
 	})
 
-	// OpenAI API keys (sk-...)
+	// OpenAI API keys: legacy sk-..., and the current sk-proj-/sk-svcacct-/
+	// sk-admin- forms whose suffix also carries '_' and '-'. The legacy branch
+	// stays alphanumeric so sk-ant- keys still reach anthropic_key below.
 	s.patterns = append(s.patterns, &secretPattern{
 		name:  "openai_key",
-		regex: regexp.MustCompile(`\b(sk-[A-Za-z0-9]{20,})\b`),
+		regex: regexp.MustCompile(`\b(sk-(?:(?:proj|svcacct|admin)-[A-Za-z0-9_\-]{20,}|[A-Za-z0-9]{20,}))\b`),
 		maskFunc: func(key string) string {
 			if len(key) <= 5 {
 				return "****"

internal/logs/sanitizer_openai_project_key_test.go

@@ -0,0 +1,27 @@
+package logs
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestSanitizer_OpenAIProjectAndServiceAccountKeys(t *testing.T) {
+	s := newTestSanitizer()
+	for _, key := range []string{
+		"sk-proj-AbCdEf1234567890_GhIjKl-MnOpQrStUvWxYz0123456789",
+		"sk-svcacct-AbCdEf1234567890_GhIjKl-MnOpQrStUvWxYz0123456789",
+		"sk-admin-AbCdEf1234567890GhIjKlMnOpQrStUvWxYz0123456789",
+		"sk-AbCdEf1234567890GhIjKlMnOpQrStUvWxYz0123456789", // legacy
+	} {
+		out := s.sanitizeString("using key " + key + " for upstream")
+		if strings.Contains(out, key) || strings.Contains(out, key[12:]) {
+			t.Errorf("OpenAI key leaked: %q", out)
+		}
+	}
+
+	// sk-ant- keys keep their own, longer-prefix mask.
+	ant := "sk-ant-api03-" + strings.Repeat("aB3dE", 8)
+	if out := s.sanitizeString("key " + ant); !strings.Contains(out, "sk-ant-api***") {
+		t.Errorf("anthropic key no longer masked by anthropic_key: %q", out)
+	}
+}