security: do not write Less Computer approval capability tokens to logs #810

Finding

resolve_less_computer_approval() currently writes the full one-time approval token at info level for both accepted and stale/duplicate requests:

[less-computer] 审批 token=<uuid> approved=<bool>

The token is a short-lived capability that resolves a pending high-risk command approval. The Tauri command is correctly restricted to the less-computer window and the token expires after 90 seconds, but emitting the raw capability into persistent logs is unnecessary exposure.

Required fix

• Preserve useful approval outcome/expired telemetry without logging the token or a reversible value derived from it.
• Audit adjacent Less Computer events/log statements for the same capability leak.
• Add a focused source/behavior contract so the raw token cannot be reintroduced into log formatting.
• Do not change approval UI, timeout, command execution, or window authorization behavior.

Acceptance

• Focused tests pass.
• cargo test --locked passes.
• Existing frontend build/contract checks pass.
• Security reviewer confirms no token appears in logs or error strings.

Found during the 2026-07-14 full-repository security review.