Block web access to log files and stop logging sensitive field values

.htaccess: deny all requests to *.log files so error.log and the CRM
audit logs are not directly browser-accessible.

database.php: remove field value from the audit log entry — client
names, emails, and signatures were being written in plaintext. Log
only the DRG and field name with a timestamp, which is sufficient for
debugging without exposing personal data.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.htaccess

@@ -16,4 +16,8 @@ Options -Indexes
 
 <FilesMatch "\.md$">
     Require all denied
+</FilesMatch>
+
+<FilesMatch "\.log$">
+    Require all denied
 </FilesMatch>

database.php

@@ -24,7 +24,7 @@ if($action == 'client-brief') {
     $fieldName = trim(mysqli_real_escape_string($con, $_POST["field_name"]));
     $fieldValue = trim(mysqli_real_escape_string($con, $_POST["field_value"]));
 
-	error_log(":" .$drg . "," . $fieldName . "," . $fieldValue . ",", 3, "error.log");
+	error_log(date('Y-m-d H:i:s') . " update drg={$drg} field={$fieldName}" . PHP_EOL, 3, "error.log");
 
     if ($fieldName == "postal_address" ) {
         $updateval = trim(preg_replace('/\s\s+/', ' ', str_replace('\n', '', $fieldValue) ));