packages/logging has no test project, so sanitize() has no measured coverage

[toruiwasa]

Raised by the review of PR #110 (Task 9 / #12).

Field	Contents
Goal	packages/logging/src/index.ts is covered by a suite that measures it, so its per-file coverage can be reported against the CLAUDE.md > Testing target like any other changed file.
Context	The package has a build script but no test script and no test runner. Its behaviour is exercised indirectly — apps/mobile maps @pulseticker/logging to src/index.ts via moduleNameMapper and its logger tests now drive sanitize() through nested objects, arrays, cycles and non-plain values; apps/web and apps/api exercise it through their own loggers. So the code is genuinely executed, but no collectCoverageFrom includes it and no run reports a number for it. This predates PR #110, which surfaced it by making sanitize() recursive: the deepest redaction path is the one most worth a direct test, and it is asserted today only from another package's suite.
Scope	Add a test runner and a test script to packages/logging, and unit tests for sanitize() and REDACTED_KEYS covering key matching (case-insensitive), nesting depth, arrays, cycles, and the deliberate pass-through of class instances. Open decision: which runner — matching apps/api's Jest keeps one config idiom for the Node-side packages, but the package is NodeNext ESM and Vitest needs less setup for that. Check what packages/schemas and packages/trading-utils do first and follow it rather than introducing a third pattern.
Test boundary	Pure functions, no I/O, no mocks. The existing indirect assertions in apps/mobile and apps/web stay where they are — they test each logger's use of sanitize(), which is a different boundary.
Done when	pnpm --filter @pulseticker/logging test runs and reports per-file coverage for src/index.ts at the 90-95% target, and the turbo test task picks the package up.
Branch	test/logging-package-coverage
Dependency	none
Risk	LOW — adds a test project only; no source change. The one thing to get right is not letting a new runner config collide with the root turbo test task.