Fix: API tracking persists client IP, User-Agent and query strings for every request and exposes them via unauthenticated /api/tracking endpoints

[WesternConcrete]

Summary

Finding: API tracking persists client IP, User-Agent and query strings for every request and exposes them via unauthenticated /api/tracking endpoints (NS compliance gap)
Repo: COG-GTM/ftgo-monolith

Fix approach: stop collecting the identifying fields, bound retention, and put an auth boundary in front of the read API.

• ApiRequestLog / ApiTrackingInterceptor: drop remoteAddr, userAgent, queryString; the entity now records only correlation id, method, URI, status, duration, error message and timestamp. New Flyway V3__remove_pii_from_api_request_log.sql drops the three columns.
• ApiRequestLogRetentionJob (@Scheduled, hourly by default) deletes rows older than ftgo.api-tracking.retention-days (default 7) via ApiRequestLogRepository.deleteOlderThan; ApiTrackingConfiguration gains @EnableScheduling.
• ApiTrackingSecurityConfiguration (new spring-boot-starter-security dep in ftgo-common): /api/tracking/** requires HTTP Basic auth, everything else stays permitAll; CSRF disabled / stateless so the existing JSON APIs and end-to-end tests are unaffected. Credentials come from Spring Boot's spring.security.user.name/password (a random password is generated and logged if unset) — nothing is committed.

Note: local Gradle build could not be verified in this session because Maven Central returned HTTP 429 (rate limited) for all artifact downloads; relying on CI.

Link to Devin session: https://app.devin.ai/sessions/2aa54ffd887c442a8c8a716040545202
Open in Devin Desktop: https://app.devin.ai/desktop/session/2aa54ffd887c442a8c8a716040545202?variant=devin
Requested by: @WesternConcrete

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring