fix: redact gateway session header from Caddy logs

test/runtime-secret-boundary.test.mjs

@@ -38,3 +38,9 @@ test('runtime entrypoint removes raw repository secrets before launching PM2', a
   assert.ok(httpsUnset > 0 && httpsUnset < pm2Start);
   assert.ok(sshUnset > 0 && sshUnset < pm2Start);
 });
+
+test('Caddy runtime logs remove the custom Gateway session header', async () => {
+  const caddyfile = await fs.readFile(new URL('../caddy/Caddyfile', import.meta.url), 'utf8');
+
+  assert.match(caddyfile, /log\s*\{[\s\S]*format filter\s*\{[\s\S]*request>headers>X-Session-Token delete/);
+});