chore: redact api-key headers in debug logs