24-Aug-2026 — enforce credential redaction and retire lastSyncCursor ref #328

build 850 — commit 3d11f09

Add a redactCredentials helper that strips api_key values from any string and apply it to network error messages, turning the no-key-in-logs guarantee into an enforced, tested control rather than an incidental one.

Remove the inert lastSyncCursor field left over from the legacy incremental client, and add a migration to unset it from persisted salesforce config.