fix: harden grok oauth gateway paths

backend/internal/repository/grok_oauth_client.go

@@ -10,6 +10,7 @@ import (
 	infraerrors "github.com/Wei-Shaw/sub2api/internal/pkg/errors"
 	"github.com/Wei-Shaw/sub2api/internal/pkg/xai"
 	"github.com/Wei-Shaw/sub2api/internal/service"
+	"github.com/Wei-Shaw/sub2api/internal/util/logredact"
 	"github.com/imroc/req/v3"
 )
 
@@ -105,7 +106,7 @@ func grokOAuthStatusError(code, message string, resp *req.Response) error {
 	body := ""
 	if resp != nil {
 		upstreamStatus = resp.StatusCode
-		body = resp.String()
+		body = logredact.RedactText(resp.String())
 	}
 	return infraerrors.Newf(statusCode, errorCode, "%s: status %d, body: %s", message, upstreamStatus, body)
 }

backend/internal/repository/grok_oauth_client_test.go

@@ -85,3 +85,23 @@ func TestGrokOAuthClientRefreshForbiddenClassifiesEntitlement(t *testing.T) {
 	require.Error(t, err)
 	require.Contains(t, strings.ToUpper(err.Error()), "GROK_OAUTH_ENTITLEMENT_DENIED")
 }
+
+func TestGrokOAuthClientStatusErrorRedactsSensitiveResponseBody(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusBadRequest)
+		_, _ = w.Write([]byte(`{"error":"invalid_grant","access_token":"access-secret","refresh_token":"refresh-secret","code_verifier":"verifier-secret"}`))
+	}))
+	defer server.Close()
+	t.Setenv(xai.EnvTokenURL, server.URL)
+
+	client := NewGrokOAuthClient()
+	_, err := client.RefreshToken(context.Background(), "refresh-secret", "", "client-id")
+	require.Error(t, err)
+
+	errText := err.Error()
+	require.Contains(t, errText, "status 400")
+	require.Contains(t, errText, `"refresh_token":"***"`)
+	require.NotContains(t, errText, "access-secret")
+	require.NotContains(t, errText, "refresh-secret")
+	require.NotContains(t, errText, "verifier-secret")
+}