feat(5.6): observabilitate + jurnal aplicatie + lifecycle trimiteri blocate

Implementeaza PRD 5.6 complet (14 stories, TDD). Doua axe:

Lifecycle trimiteri blocate (Val A):
- submissions_admin.py: sterge/repune scoped (404 cross-account inaintea lui 409 stare)
- reactivare dedup peste `error` cu CAS (WHERE id=? AND status='error'), creds noi in
  submissions + accounts.rar_creds_enc; worker invalideaza sesiunea RAR la creds proaspete
  (JWT 30h vechi nu mai trimite cu parola gresita); camp aditiv `reactivated:true`
- retentie randuri blocate 30z; purge_expired exclude queued/sending; purge_after curatat
  la reactivare/requeue
- API DELETE /v1/prezentari/{id} + /repune (200+JSON); UI butoane + bulk + banner actionabil

Observabilitate:
- app/observ.py log_event: dublu canal app_events (DB) + RotatingFileHandler per-proces,
  redactare creds/PII la scriere (redact_pii/vin_partial)
- request_id middleware + X-Request-ID pe toate raspunsurile
- handler global excepții -> 500 envelope 6-chei + request_id (traceback doar in jurnal)
- audit cerere API (api_prezentari/api_auth_esuat) + audit worker (rar_login/tranzitii)
- tab "Jurnal" filtrabil scoped (non-admin doar contul sau); retentie jurnal 90z
- rar_error expus in GET /v1/prezentari/{id} (recovery observabil)

pytest -q: 741 passed, 0 failed. Docs: PRD raport VERIFY, contract endpointuri noi, ROADMAP.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/security.py

@@ -39,6 +39,46 @@ SENSITIVE_KEYS = frozenset(
 )
 
 
+# Chei al caror continut e PII de identificare vehicul/proprietar: se logheaza DOAR
+# partial (ultimele 4), niciodata integral (PRD 5.6 US-007, L.142/GDPR).
+PII_PARTIAL_KEYS = frozenset({"vin", "nr_inmatriculare", "nr", "numar"})
+
+
+def vin_partial(value: Any) -> str:
+    """VIN/numar mascat partial: pastreaza ultimele 4 caractere, restul `…`.
+
+    'WVWZZZ1KZAW000123' -> 'WVW…0123'. Sub 4 caractere -> doar masca. Suficient
+    pentru a corela un rand fara a expune identificatorul integral in jurnal.
+    """
+    s = str(value if value is not None else "").strip()
+    if not s:
+        return ""
+    if len(s) <= 4:
+        return "…"
+    return f"{s[:3]}…{s[-4:]}" if len(s) > 7 else f"…{s[-4:]}"
+
+
+def redact_pii(obj: Any) -> Any:
+    """Ca `scrub`, plus mascare partiala a VIN/numar (PII_PARTIAL_KEYS).
+
+    Folosit la scrierea jurnalului (observ.log_event): mai intai mascam credentialele
+    integral (scrub), apoi reducem VIN/nr la forma partiala. Recursiv pe dict/list.
+    """
+    if isinstance(obj, dict):
+        out: dict = {}
+        for k, v in obj.items():
+            if isinstance(k, str) and k.lower() in SENSITIVE_KEYS:
+                out[k] = MASK
+            elif isinstance(k, str) and k.lower() in PII_PARTIAL_KEYS and not isinstance(v, (dict, list)):
+                out[k] = vin_partial(v)
+            else:
+                out[k] = redact_pii(v)
+        return out
+    if isinstance(obj, (list, tuple)):
+        return [redact_pii(v) for v in obj]
+    return obj
+
+
 def scrub(obj: Any) -> Any:
     """Copie a structurii cu valorile cheilor sensibile mascate, recursiv.