feat: anonymize IPs via HMAC before persisting to MongoDB

GDPR compliance — IPs are HMAC-SHA256'd (truncated to 16 hex chars)
before being pushed to the Redis queue, so only pseudonymous tokens
are ever stored.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/middleware/requestLogger.ts

@@ -8,7 +8,7 @@ export default defineEventHandler((event) => {
 
   event.node.res.on("finish", () => {
     logRequest({
-      ip,
+      ip: anonymizeIp(ip),
       path,
       method,
       statusCode: event.node.res.statusCode,

server/utils/requestLogger.ts

@@ -1,3 +1,5 @@
+import { createHmac } from "node:crypto";
+
 export interface RequestLogEntry {
   ip: string;
   path: string;
@@ -7,6 +9,11 @@ export interface RequestLogEntry {
   timestamp: string;
 }
 
+export function anonymizeIp(ip: string): string {
+  const secret = useRuntimeConfig().adminPassword || "default-hmac-key";
+  return createHmac("sha256", secret).update(ip).digest("hex").slice(0, 16);
+}
+
 export function logRequest(data: RequestLogEntry): void {
   try {
     const redis = getRedis();