Add logging to silent backend exception handlers (BE-JN-001)

[Joe225208726]

Summary

Adds logging to seven backend exception handlers that previously recovered from failures without leaving any trace. Each handler now records the failure before recovering, so silent failures become diagnosable. Recovery behaviour is unchanged.

Type of Change

• Bug fix
• New feature
• Breaking change
• Refactor / code cleanup
• Documentation
• CI/CD / infrastructure
• Security

Affected Components

• /backend-api
• /frontend
• /engine (collectors / policies)
• /security
• /infrastructure
• /.github/workflows
• /docs

Motivation

Several broad exception handlers in the backend recovered from failures silently, with no log output, which made those failures impossible to diagnose. This adds visibility without changing how the code recovers. Task: BE-JN-001.

Changes:

• auth.py: the three Google OAuth callback failures (token exchange, userinfo fetch, account linking), logged at exception level.
• evidence.py: the validator pre-pass and the validator-persist rollback, logged at warning level.
• scan_readiness.py: the permission probe failure, logged at warning level.

Testing Done

• Unit tests pass locally
• Tested manually — describe how:
  Triggered a Google OAuth token exchange failure locally. The handler now emits "ERROR api Google OAuth token exchange failed" with a full traceback, where previously the same failure recovered silently with only a 302 redirect and no log entry. Backend builds and boots cleanly with the change. Before/after log screenshots below.
• No tests required — explain why:

Security Considerations

No security impact. This change only adds log statements and does not touch auth logic, secrets, permissions, or data exposure. The log messages are static strings and do not include tokens, credentials, or user data.

Breaking Changes

• No breaking changes
• Yes — describe below:

Rollback Plan

• Revert commit is sufficient
• Requires additional steps — describe below:

Checklist

• Code follows project conventions
• No secrets, credentials, or tokens committed
• Relevant documentation updated (if applicable)
• CI/CD workflows pass on this branch
• PR is focused on one thing

Screenshots

Before: OAuth token exchange fails, only a 302 is logged with no error line. After: the same failure now logs "ERROR api Google OAuth token exchange failed" with a traceback pointing to auth.py.

[github-actions]

Preview Environment

A preview environment can be spun up on demand for this PR.

Action	Label	Includes
Spin up preview	deploy-preview	Frontend, backend, database, Redis, OPA, worker
Spin up preview with M365	deploy-preview-m365	Everything above + PowerShell service for Exchange/Teams scan testing
Tear down preview	teardown-preview	Stops the environment early

The environment will also be torn down automatically when the PR is closed or merged.
Preview URLs will appear in a follow-up comment once the deploy completes (~5–8 min).
M365 scans require real tenant credentials added through the frontend UI.

[github-actions]

CI: Backend API

Job	Result
Security analysis (CodeQL + Bandit)	❌ failure
Lint	❌ failure

One or more checks failed. View logs