backend-security-patterns

Combined backend protocols for authentication (Clerk JWT verification) and PII-safe observability. Use when handling auth on the server, verifying Clerk webhooks via `svix`, scoping metadata via `publicMetadata`/ `privateMetadata`, or sanitizing logs to keep emails, tokens, and request bodies out of telemetry.