Production LDK TRACE logging persists preimages and full payment metadata to on-disk logs

[coreyphillips]

Severity: Medium (privacy; partial secret exposure)

LDK logs a full payment preimage at TRACE on the duplicative-fulfill path (rust-lightning, lightning/src/ln/outbound_payment.rs:2346). The app sets the LDK log level to TRACE unconditionally, with no build-type gating (Env.swift:137), and persists every log line to session files under the app storage logs directory (Logger.swift:152-194).

Beyond preimages, TRACE continuously records payment hashes, amounts, channel points, peer pubkeys, onchain addresses, and invoice contents: a near-complete financial activity record on disk. The logs are exportable from the app, and the Recovery home-screen quick action exposes "Export Logs" before any PIN authentication, so the archive is reachable on a locked install.

Steps to reproduce:

1. Make a few Lightning payments.
2. Export the logs (in-app export, or long-press the app icon -> Recovery -> Export Logs without unlocking).
3. Grep the archive for payment_preimage, amounts, and node pubkeys.

Suggested fix:

• Set the production LDK log level to INFO or WARN; gate TRACE behind a debug-only flag.
• Redact the preimage log line upstream, or filter payment_preimage-shaped arguments in the app's log writer.
• Require authentication before the Recovery log export.

Sibling issue: synonymdev/bitkit-android#1145 (same TRACE level and preimage log there).