fix(security): close backend merge blockers

tests/api/test_audit_middleware.py

@@ -7,6 +7,21 @@ from fastapi.testclient import TestClient
 
 from app.infra.audit import middleware as audit_middleware
 from app.infra.audit.middleware import AuditMiddleware
+from app.core.audit import sanitize_sensitive_data
+
+
+def test_sanitize_sensitive_data_redacts_database_dsn() -> None:
+    raw_dsn = "postgresql://alice:supersecret@db.internal/project"
+
+    sanitized = sanitize_sensitive_data(
+        {"dsn": raw_dsn, "database": {"readonly_dsn": raw_dsn}}
+    )
+
+    assert sanitized == {
+        "dsn": "***REDACTED***",
+        "database": {"readonly_dsn": "***REDACTED***"},
+    }
+    assert raw_dsn not in str(sanitized)
 
 
 def test_post_streaming_response_survives_audit_body_capture(monkeypatch):