Redact PII from Square webhook logging

payment.updated/refund.updated handlers log only the Square object id and payload length instead of the raw JSON body (which contained buyer email, card brand/last4, cardholder name). Add a test asserting no raw payload reaches the log.

backend/handlers/webhooks/square.go

@@ -145,10 +145,26 @@ func verifySquareSignature(body []byte, signature, signingKey, notificationURL s
 	return hmac.Equal([]byte(signature), []byte(expected))
 }
 
+// handlePaymentUpdated logs only the Square object id — never the raw payload,
+// which contains PII (buyer email, card brand/last4, cardholder name, billing
+// address, amounts). The envelope's event_id is logged at the dispatch site.
+// On unmarshal failure log just the byte length (no content).
 func handlePaymentUpdated(data json.RawMessage) {
-	log.Printf("[SQUARE-WEBHOOK] payment.updated: %s", string(data))
+	var obj struct{ ID string `json:"id"` }
+	if err := json.Unmarshal(data, &obj); err != nil {
+		log.Printf("[SQUARE-WEBHOOK] payment.updated received (payload length=%d)", len(data))
+		return
+	}
+	log.Printf("[SQUARE-WEBHOOK] payment.updated received (data.id=%s)", obj.ID)
 }
 
+// handleRefundUpdated logs only the Square object id — never the raw payload,
+// which contains PII. See handlePaymentUpdated.
 func handleRefundUpdated(data json.RawMessage) {
-	log.Printf("[SQUARE-WEBHOOK] refund.updated: %s", string(data))
+	var obj struct{ ID string `json:"id"` }
+	if err := json.Unmarshal(data, &obj); err != nil {
+		log.Printf("[SQUARE-WEBHOOK] refund.updated received (payload length=%d)", len(data))
+		return
+	}
+	log.Printf("[SQUARE-WEBHOOK] refund.updated received (data.id=%s)", obj.ID)
 }