fix(glooko): use per-collection cursors and redact private logs

[HockeyTrafalgar]

Summary

• use the Nightscout treatment bookmark for Glooko pump basal/bolus requests
• keep using the entry bookmark for Glooko CGM requests
• stop logging source credentials, authentication responses, patient-bearing request URLs, and raw persistence batches
• add regression coverage for the cursor selection and privacy boundaries

Situation encountered

We diagnosed this on a Nightscout deployment that runs a current CGM source alongside the experimental Glooko connector. The connector was polling on its expected five-minute cadence, and direct comparison showed that Glooko had newer pump treatment records which were still absent from Nightscout.

The important state was that last_known.entries was close to real time because glucose ingestion was healthy, while last_known.treatments was older. dataFromSesssion built Glooko's lastUpdatedAt and limit from the entry bookmark for every endpoint. The newer glucose timestamp therefore collapsed the pump request window even though treatment ingestion was behind, so queued basal/bolus records could be skipped on every poll.

Using the treatment bookmark for pump endpoints allowed the missing backlog to be returned on the next cycle. A source-to-database comparison by stable record identifier then found no missing pump boluses. This PR generalizes that operational fix without making Glooko CGM inefficient: pump basal/bolus requests use last_known.treatments, while CGM and graph requests retain last_known.entries.

During the same investigation, normal Docker logs were found to contain several categories of private data:

• the validated source configuration, including account credentials
• Glooko authentication response headers and bodies, including session cookies and account/patient identifiers
• request URLs containing the Glooko patient code
• complete Nightscout batches and persistence results, including medical records

The replacement logs retain useful status, route, and collection-count information without emitting those payloads. No production credentials, identifiers, or medical values are included in this PR or its fixtures.

Regional endpoint context

The deployed 0.0.12 package also had a hard-coded EU Host header that conflicted with a successfully selected non-EU API base URL. Current main already derives Host from baseURL and has a regional-host regression assertion, so this PR deliberately does not duplicate that fix.

Tests

• Added a regression where glucose is five minutes old but treatments are three hours old; pump requests must use the treatment cursor while CGM uses the entry cursor.
• Added log-capture regressions proving that credentials, cookies, patient codes, and raw batches are absent.
• npm test passes: 51 tests, 0 failures.

Risk and compatibility

The existing 48-hour fallback remains unchanged when a collection has no bookmark. Authentication, conversion, and persistence behavior are unchanged; only per-endpoint cursor selection and log detail are affected.