Replace unsalted recipientHash with Key Vault HMAC digest

[patoperpetua]

Parent: #6
Depends on: none

Goal

Replace the unsalted SHA-256 recipientHash in send telemetry with a Key Vault–managed HMAC digest so log readers cannot correlate recipients offline by hashing candidate addresses.

Background

CodeRabbit flagged this on PR #80 (#39). The current hashRecipient() in apps/api/src/telemetry/logger.ts is a deterministic 16-char SHA-256 prefix. That is sufficient for duplicate detection within logs but is reversible via offline guessing against known address lists.

Scope

• Load an HMAC key from Azure Key Vault ssd-global-kv-prod-ae (follow existing OIDC/Key Vault patterns — no secrets in repo)
• Include a key-version identifier in the emitted recipientHash value when the key rotates
• Update send-metrics-queries.md and troubleshooting docs if the field format changes
• Migration note: historical logs keep the old digest shape; document the cutover

Constraints

• Never log raw recipient addresses
• No tokens or key material in GitHub Issues, PRs, or git
• Backward compatible query guidance for operators during transition

Acceptance criteria

• recipientHash uses HMAC with a Key Vault secret
• Key version is distinguishable in telemetry
• Tests cover digest shape without live Key Vault in unit tests (injectable secret)
• Docs updated