fix: redact legacy incoming call log

[Justinabox]

Summary

• Redact the caller identifier in the legacy run_server() auto-answer INFO log using the existing phone-number redactor.
• Add a focused regression test that requires the masked operator message and rejects raw or partial identifier text.

Verification

• git diff --check
• PYTHONPATH=. uv run --no-project --with pytest --with pytest-asyncio --with pytest-aiohttp --with pyserial-asyncio --with aiosqlite pytest tests/test_api_auth.py::TestServerPrivacyLogging::test_incoming_call_log_redacts_session_number -q — 1 passed
• PYTHONPATH=. uv run --no-project --with pytest --with pytest-asyncio --with pytest-aiohttp --with pyserial-asyncio --with aiosqlite pytest tests/ -q — 992 passed

TDD evidence

The strengthened regression test was proven to fail against a temporary local raw-logging mutation, then the redaction call was restored. The temporary mutation was not committed.

Scope / risk

Narrow logging-only change. It preserves the existing incoming-call and greeting wording while removing raw caller data from the default server log.

Related to #61. This PR intentionally covers one log path only; other logging surfaces remain out of scope.

[Justinabox]

Release review: needs-fix (privacy blocker); not ready to land.

The numeric caller-ID regression is good, but the +CLIP parser accepts arbitrary non-quote caller identifiers. redact_phone_number() intentionally preserves values without digits, so a modem-provided non-numeric identifier can still be emitted verbatim by the legacy auto-answer INFO log.

Please run a fresh TDD cycle: add a parser/session-reachable regression using a non-numeric sentinel caller identifier and assert the full value is absent from captured logs; then make this legacy auto-answer logging path fail closed for arbitrary CallSession.number values. Rebase on current main, rerun git diff --check plus the required full pytest gate, and request fresh privacy review.

[Justinabox]

Release review: superseded candidate / do not merge alongside #251. This shares the same original auto-answer log statement and retains the same non-numeric caller-ID leak because redact_phone_number() is fail-open for strings without digits. #251 has the stronger end-to-end test and is the canonical successor once it adds a fail-closed non-numeric boundary regression. Please do not rebase this duplicate; it can be closed after corrected #251 lands.

[Justinabox]

Release review: superseded by the more complete overlapping caller-log slice in #251. #251 itself currently needs a fail-closed nonnumeric caller-ID redaction fix before either approach should land; please consolidate follow-up work there rather than refreshing this duplicate branch.

[Justinabox]

Release-lane classification: needs fix/revalidation before merge.

This draft was not independently reviewed or integration-tested in this pass and its GitHub mergeability is stale/unknown after current-main advances. Please rebase or otherwise validate it against current main, run the required full local gate, and request a fresh release review with exact head SHA and gate evidence. Do not treat absence of hosted checks as approval.

[Justinabox]

Release classification: needs-fix for this release pass.

The draft has not received a current exact-head review and prescribed local integration gate over the advancing main baseline. Rebase/repackage as needed against current main, resolve any conflicts, then provide a narrow behavioral review plus passing git diff --check and the prescribed full test suite before it can be reconsidered for landing.

[Justinabox]

Release review: needs-fix. The new helper still uses redact_phone_number(), which preserves no-digit caller IDs verbatim. Add a no-digit sentinel through the incoming-call logging path, switch to a fail-closed caller-ID log value, rebase on current origin/main, and rerun required gates.