Fix JSON log field forgery by serializing with json.dumps

[groupthinking]

Prevent attacker-controlled quotes in JSON log messages from forging/overriding fields by building dict records and serializing with json.dumps.

[linear-code]

GRV-374

[coderabbitai]

⚠️ Possible Duplicate Issue(s)

• GRV-348
• fix(security): CWE-117 JSON field forgery via unescaped " survives the #1270 log sanitizer #1429

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[github-actions]

👋 Thanks for opening this issue! It has been automatically labeled for triage.

[groupthinking]

Covered on main by #1515 (35169d387) and the StructuredFormatter path.

Acceptance: attacker-controlled quotes in log messages must not forge JSON fields.

StructuredFormatter._format_json builds a dict and serializes with json.dumps(..., ensure_ascii=True, allow_nan=False) — see src/youtube_extension/backend/config/logging_config.py. Regression coverage is in tests/unit/test_logging_config_crlf.py.

Closing as done rather than leaving a duplicate high-priority ticket.