fix(t233): add redacted ERP diagnostics

backend-api/internal/config/config.go

@@ -23,6 +23,7 @@ const (
 	ShunyunbaoUsernameEnvironment = "CMROUBAO_SHUNYUNBAO_USERNAME"
 	ShunyunbaoPasswordEnvironment = "CMROUBAO_SHUNYUNBAO_PASSWORD"
 	OCRAPIURLEnvironment          = "CMROUBAO_OCR_API_URL"
+	ERPDebugLogEnvironment        = "CMROUBAO_ERP_DEBUG_LOG"
 
 	defaultHTTPAddress    = "127.0.0.1:8080"
 	defaultDatabasePath   = "var/cmroubao.db"
@@ -55,6 +56,7 @@ type Config struct {
 	ShunyunbaoPassword string
 	OCRAPIURL          string
 	ShunyunbaoTimeout  time.Duration
+	ERPDebugLog        bool
 }
 
 func Load(lookup LookupEnvironment) (Config, error) {
@@ -186,6 +188,10 @@ func Load(lookup LookupEnvironment) (Config, error) {
 	if ocrAPISet && !validOCRAPIURL(ocrAPIURL) {
 		return Config{}, errors.New(OCRAPIURLEnvironment + " must be an approved OCR endpoint")
 	}
+	erpDebugLog, err := booleanEnvironment(lookup, ERPDebugLogEnvironment, false)
+	if err != nil {
+		return Config{}, err
+	}
 
 	return Config{
 		HTTPAddress:        httpAddress,
@@ -207,6 +213,7 @@ func Load(lookup LookupEnvironment) (Config, error) {
 		ShunyunbaoPassword: shunyunbaoPassword,
 		OCRAPIURL:          ocrAPIURL,
 		ShunyunbaoTimeout:  30 * time.Second,
+		ERPDebugLog:        erpDebugLog,
 	}, nil
 }
 
@@ -267,6 +274,25 @@ func durationEnvironment(
 	return duration, nil
 }
 
+func booleanEnvironment(
+	lookup LookupEnvironment,
+	name string,
+	defaultValue bool,
+) (bool, error) {
+	value, exists := lookup(name)
+	if !exists {
+		return defaultValue, nil
+	}
+	switch strings.ToLower(strings.TrimSpace(value)) {
+	case "true":
+		return true, nil
+	case "false":
+		return false, nil
+	default:
+		return false, errors.New(name + " must be true or false")
+	}
+}
+
 func cleanOptionalPath(value string) string {
 	if value == "" {
 		return ""

backend-api/internal/config/config_test.go

@@ -44,7 +44,7 @@ func TestLoadUsesSafeDefaults(t *testing.T) {
 	}
 	if cfg.ShunyunbaoURL != "https://www.shunyunbaoerp.com" ||
 		cfg.ShunyunbaoUsername != "" || cfg.ShunyunbaoPassword != "" ||
-		cfg.ShunyunbaoTimeout != 30*time.Second {
+		cfg.ShunyunbaoTimeout != 30*time.Second || cfg.ERPDebugLog {
 		t.Fatalf(
 			"shunyunbao defaults = %q / %q / %q / %s",
 			cfg.ShunyunbaoURL,
@@ -68,6 +68,7 @@ func TestLoadAcceptsExplicitConfiguration(t *testing.T) {
 		ShunyunbaoURLEnvironment:      "https://erp.example.test:8443",
 		ShunyunbaoUsernameEnvironment: "service-user",
 		ShunyunbaoPasswordEnvironment: " pass with spaces ",
+		ERPDebugLogEnvironment:        "true",
 	}
 
 	cfg, err := Load(mapEnvironment(values))
@@ -104,7 +105,8 @@ func TestLoadAcceptsExplicitConfiguration(t *testing.T) {
 	}
 	if cfg.ShunyunbaoURL != values[ShunyunbaoURLEnvironment] ||
 		cfg.ShunyunbaoUsername != values[ShunyunbaoUsernameEnvironment] ||
-		cfg.ShunyunbaoPassword != values[ShunyunbaoPasswordEnvironment] {
+		cfg.ShunyunbaoPassword != values[ShunyunbaoPasswordEnvironment] ||
+		!cfg.ERPDebugLog {
 		t.Fatalf("shunyunbao config was not preserved")
 	}
 }
@@ -138,6 +140,12 @@ func TestLoadRejectsUnsafeOrInvalidValues(t *testing.T) {
 				ShunyunbaoPasswordEnvironment: "password",
 			},
 		},
+		{
+			name: "invalid ERP debug log",
+			values: map[string]string{
+				ERPDebugLogEnvironment: "yes",
+			},
+		},
 		{
 			name: "blank explicit address",
 			values: map[string]string{

backend-api/internal/config/envfile.go

@@ -123,7 +123,8 @@ func isERPEnvironmentName(name string) bool {
 	case ShunyunbaoURLEnvironment,
 		ShunyunbaoUsernameEnvironment,
 		ShunyunbaoPasswordEnvironment,
-		OCRAPIURLEnvironment:
+		OCRAPIURLEnvironment,
+		ERPDebugLogEnvironment:
 		return true
 	default:
 		return false

backend-api/internal/config/envfile_test.go

@@ -14,6 +14,7 @@ func TestWithERPEnvironmentFileUsesApprovedFallbackValues(t *testing.T) {
 		"CMROUBAO_SHUNYUNBAO_USERNAME=dotenv-user",
 		"CMROUBAO_SHUNYUNBAO_PASSWORD='dotenv password #1'",
 		"CMROUBAO_OCR_API_URL=http://127.0.0.1:8000/ocr",
+		"CMROUBAO_ERP_DEBUG_LOG=true",
 	}, "\n"))
 
 	lookup, err := WithERPEnvironmentFile(path, func(string) (string, bool) {
@@ -29,7 +30,7 @@ func TestWithERPEnvironmentFileUsesApprovedFallbackValues(t *testing.T) {
 	if cfg.ShunyunbaoURL != "https://erp.example.test" ||
 		cfg.ShunyunbaoUsername != "dotenv-user" ||
 		cfg.ShunyunbaoPassword != "dotenv password #1" ||
-		cfg.OCRAPIURL != "http://127.0.0.1:8000/ocr" {
+		cfg.OCRAPIURL != "http://127.0.0.1:8000/ocr" || !cfg.ERPDebugLog {
 		t.Fatalf(
 			"ERP config = %#v",
 			struct {