Security hardening: logging, cost protection, SSRF, model validation

[neuromechanist]

Summary

Addresses four security issues:

• Add API key log redaction #65 - API key log redaction: Wired up configure_secure_logging() in app startup (src/api/main.py) so SecureFormatter is active before any logging occurs. The formatter and tests already existed but were never called.
• Add SSRF protection for documentation URLs #66 - SSRF protection: Verified existing validate_source_url() in DocSource with comprehensive test coverage (localhost, private IPs, AWS metadata, non-HTTP schemes). No gaps found.
• Add cost manipulation protection #67 - Cost manipulation protection: Added _check_model_cost() guard in create_community_assistant() that blocks models above $15/1M input tokens on platform/community keys (HTTP 403), warns above $5/1M. BYOK users are unrestricted. Unknown models are allowed.
• Add model name format validation #68 - Model name validation: Verified existing _validate_model_id() with pattern+length validation and comprehensive tests. No gaps found.

Closes #65, closes #66, closes #67, closes #68

Test plan

• uv run pytest tests/test_api/test_cost_protection.py -v -- 6 passed, 1 skipped (no models between warn/block thresholds)
• uv run pytest tests/test_core/test_config/test_community.py -v -- SSRF + model validation tests pass
• uv run ruff check . && uv run ruff format --check . -- clean
• Full test suite: 1605 passed, 18 skipped, 5 pre-existing failures (CLI standalone, unrelated)
• Verify on dev: start server, confirm logs use SecureFormatter
• Verify on dev: attempt expensive model on platform key, confirm 403

[neuromechanist]

PR Review Findings

Ran comprehensive review with 5 agents (code-reviewer, silent-failure-hunter, pr-test-analyzer, comment-analyzer, code-simplifier). All findings addressed in follow-up commits.

Critical (1 found, fixed)

• Misleading comments: _check_model_cost had comments saying "unknown models get fallback rate" but the code actually returns early with no cost check. Fixed to accurately describe behavior.

Important (3 found, fixed)

1. No logging for unknown models: Unknown models bypassed cost protection silently with zero operator visibility. Added logger.info so operators can see when unpriced models are used.
2. Duplicated test logic: Same model-filtering list comprehension appeared in 5 of 7 tests. Extracted into _models_by_cost() helper.
3. SecureJSONFormatter broad catch (pre-existing tech debt): Catch-all Exception handler swallowed all errors with a lossy fallback, losing the original message, logger name, and error details. Split into specific expected errors (ValueError, TypeError, KeyError) with debugging context, and unexpected errors that re-raise after printing to stderr. Now matches the pattern already used in SecureFormatter.format().

Suggestions (5 found, 4 addressed)

• Added boundary test at exact block threshold
• Added BYOK + unknown model test
• Added assertion that 403 error includes BYOK guidance URL
• Fixed module docstring ("cost manipulation" -> "model cost protection")
• Literal type for key_source -- skipped, consistent with existing codebase pattern using str