Round 6 security review fixes: DRY debugLog, gate debugPrint

[sohamM97]

Summary

• LOW-21/LOW-22 fix: Extract shared debugLog() helper in display_utils.dart that gates debugPrint behind kDebugMode, preventing error details from leaking to Android logcat in release builds
• DRY refactor: Replace all 12 raw if (kDebugMode) debugPrint(...) call sites across auth_service.dart, auth_provider.dart, main.dart, and todays_five_screen.dart with debugLog()
• LOW-15 deferred: Firestore security rules version-control deferred for proper Firebase CLI setup later
• Regression test: Codebase scan test ensures no ungated debugPrint calls can be reintroduced

Test plan

• flutter analyze — 0 issues
• flutter test — 1275 tests pass (6 new tests added)
• flutter build linux — builds successfully
• Manual test: app startup, Today's 5 deadline suppression pin/unpin — all pass

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[claude]

test comment check

[claude]

Code review

Issue 1 — Bug: "debugLog import present" test always passes vacuously

File: test/utils/display_utils_test.dart lines 815-818

The condition has two logical problems that make missingImports always empty — the test is a no-op and provides no regression protection:

1. Branch 2 is impossible. content.contains('debugLog(') && !content.contains('debugLog') — any string containing debugLog( necessarily contains debugLog. Always false.
2. Branch 1 checks the wrong thing. !content.contains("import") flags files with no import statements at all — that never happens in lib/. The intent was to check for the specific display_utils.dart import.

Suggested fix:

        if (content.contains('debugLog(') &&
            !content.contains('display_utils.dart')) {

---

Issue 2 — Stale line reference in docs (CLAUDE.md: verify before documenting)

File: docs/SECURITY_REVIEW.md line 1189 and line 1288

Both references claim launchSafeUrl() is at display_utils.dart:166-182, but this PR itself inserts the 8-line debugLog() function at the top of that file, pushing launchSafeUrl down to lines 174-190.

Per CLAUDE.md: "Verify before documenting. Before writing any factual claim in a doc, verify it exists in the codebase first... Do not rely on memory, TODO lists, or stale branch knowledge."

Fix: update both occurrences of display_utils.dart:166-182 to display_utils.dart:174-190.