Function strip_body_for_logs 

pub async fn strip_body_for_logs(request: Request, next: Next) -> Response

Belt-and-braces: ensure no /auth/* request body ever reaches a logger. The runtime cost is one logger-scoped tracing span with the body field redacted; the body itself is forwarded to the handler untouched.