fix: 避免非字符串状态被误脱敏

- src/common/security/redact-sensitive.ts: 敏感字段名只对字符串整值脱敏，布尔和数字状态保持可观测

src/common/security/redact-sensitive.ts

@@ -1,3 +1,6 @@
+/**
+ * 通用脱敏工具负责清理密钥形态的字符串，同时保留布尔/数字等非密钥状态值。
+ */
 const SENSITIVE_KEY_PATTERN =
   /(token|secret|password|passwd|authorization|api[-_]?key|webhook|cookie|credential|private[-_]?key)/i;
 const INLINE_SECRET_PATTERN =
@@ -21,7 +24,9 @@ function redactValue(value: unknown): unknown {
     return Object.fromEntries(
       Object.entries(value as Record<string, unknown>).map(([key, entry]) => [
         key,
-        SENSITIVE_KEY_PATTERN.test(key) ? '[REDACTED]' : redactValue(entry),
+        SENSITIVE_KEY_PATTERN.test(key)
+          ? redactSensitiveKeyValue(entry)
+          : redactValue(entry),
       ]),
     );
   }
@@ -46,6 +51,18 @@ function redactValue(value: unknown): unknown {
   return value;
 }
 
+function redactSensitiveKeyValue(value: unknown): unknown {
+  if (typeof value === 'string') {
+    return '[REDACTED]';
+  }
+
+  if (value && typeof value === 'object') {
+    return redactValue(value);
+  }
+
+  return value;
+}
+
 function looksLikeSecret(value: string): boolean {
   const trimmed = value.trim();