fix(security): Remove sensitive auth data from console logs

[shakecodeslikecray]

Summary

• Removed logging of sensitive authentication data that could be exposed in server logs

Problem

In app/api/auth.ts:33-37, the following sensitive information was being logged to the console:

• Allowed hashed access codes (full list)
• Raw access codes from requests
• Hashed access codes
• User IP addresses

This is a security risk as these values could be exposed in:

• Server logs
• CI/CD outputs
• Log aggregation systems
• Error monitoring tools

Fix

Removed all sensitive data logging, keeping only a simple timestamp for debugging:

console.log("[Auth] request received at", new Date().toLocaleString());

Test plan

• Verify auth still works correctly
• Confirm sensitive data no longer appears in server logs

🤖 Generated with Claude Code
Bug discovered by whiterose