[alexlovelltroy]

Description

This pull request improves the security of WireGuard startup diagnostics by ensuring that the server's private key is no longer logged at INFO or DEBUG levels. It updates documentation, removes sensitive logging, and adds a test to verify that private keys are never written to logs while maintaining useful diagnostics.

Security and Logging Improvements:

• Removed logging of the WireGuard server's private key from the startup logs in StartServer, ensuring that only non-sensitive information (interface name, public key, listen port, IP address) is logged.
• Added a new test, TestStartServerDoesNotLogPrivateKey, in startup_logging_test.go to verify that the private key is never logged and that useful public diagnostics are present.

Documentation Updates:

• Added a new section to docs/security-logging.md describing the change, its impact, and clarifying that no configuration or client migration is required.

Checklist

• My code follows the style guidelines of this project
• I have added/updated comments where needed
• I have added tests that prove my fix is effective or my feature works
• I have run make test (or equivalent) locally and all tests pass
• I have updated the relevant documentation (CLI examples, man pages, README, other docs, etc.)
• DCO Sign-off: All commits are signed off (git commit -s) with my real name and email
• REUSE Compliance:
  • Each new/modified source file has SPDX copyright and license headers
  • Any non-commentable files include a <filename>.license sidecar
  • All referenced licenses are present in the LICENSES/ directory

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Dependency update
• Build system/CI

---

• I agree to follow the Code of Conduct.

[alexlovelltroy]

Marked as draft as there's one more change I want to add which better protects admin routes.

[synackd]

Sounds good. Go ahead and request my review once ready.

[alexlovelltroy]

#144 replaces this one.