Add backend policy tests and API client split

backend/utils/security.js

@@ -0,0 +1,11 @@
+const crypto = require('crypto');
+
+const stripEnvQuotes = (value = '') => value.replace(/^"|"$/g, '');
+const hashSecret = (value) => crypto.createHash('sha256').update(value).digest('hex');
+const maskSecret = (id, value) => `masked:${id}:${value.slice(-6)}`;
+
+module.exports = {
+  stripEnvQuotes,
+  hashSecret,
+  maskSecret,
+};