feat: complete T-532 cmhub account prompt

app/appconfig.py

@@ -180,14 +180,35 @@ def mask_secret(secret) -> str:
     return f"{text[:4]}***{text[-4:]}"
 
 
+def mask_email(email) -> str:
+    """Return a display-safe email string with the local part masked."""
+
+    text = str(email or "").strip()
+    if not text or "@" not in text:
+        return text
+    local, domain = text.split("@", 1)
+    if not local or not domain:
+        return mask_secret(text)
+    if len(local) == 1:
+        masked_local = "***"
+    elif len(local) == 2:
+        masked_local = f"{local[0]}***"
+    else:
+        masked_local = f"{local[0]}***{local[-1]}"
+    return f"{masked_local}@{domain}"
+
+
 def sanitize_for_log(value):
     """Return a copy of value with secret fields masked for logs/status/export."""
 
     if isinstance(value, dict):
         sanitized = {}
         for key, child in value.items():
+            lowered = str(key).lower()
             if _is_secret_field_name(key):
                 sanitized[key] = mask_secret(child)
+            elif lowered == "email" or lowered.endswith("_email"):
+                sanitized[key] = mask_email(child)
             else:
                 sanitized[key] = sanitize_for_log(child)
         return sanitized