test(web): a rejected upload is logged with its reason, never the filename or title (red)

Rejections are synchronous and leave no row, so an operator could not tell 'the
user never retried' from 'the page refused it' (it happened during the first
real-recording trial). The reason is operational; the filename and title are
the user's private content.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

internal/web/uploads_handler_test.go

@@ -3,6 +3,7 @@ package web_test
 import (
 	"bytes"
 	"context"
+	"log/slog"
 	"mime/multipart"
 	"net/http"
 	"net/http/httptest"
@@ -336,3 +337,21 @@ func TestUploadPage_AlsoCarriesTheVideoNotice(t *testing.T) {
 
 	assert.Contains(t, body(t, do(t, app, get("/uploads/"+id))), "Only its audio was used")
 }
+
+func TestUploadPost_ARejectionIsLoggedWithItsReasonAndNeverTheFilenameOrTitle(t *testing.T) {
+	// Rejections are synchronous and leave no row, so without a log line an operator
+	// cannot tell "the user never retried" from "the page refused it". The reason is
+	// operational; the filename and title are the user's private content.
+	var buf bytes.Buffer
+	app, _ := newUploadApp(t, uploads.Probe{Duration: time.Minute, HasVideo: true}, 1<<20)
+	app.Log = slog.New(slog.NewTextHandler(&buf, nil))
+
+	rec := do(t, app, uploadReq(t, "Secret project notes", "client-acme-roadmap.mp4", []byte("x")))
+
+	require.Equal(t, http.StatusUnprocessableEntity, rec.Code)
+	logged := buf.String()
+	assert.Contains(t, logged, "upload rejected")
+	assert.Contains(t, logged, "reason=no_audio")
+	assert.NotContains(t, logged, "Secret project notes", "the title is private content")
+	assert.NotContains(t, logged, "client-acme-roadmap", "the filename is private content")
+}