observability: add an optional debug/logging hook (with no credential leakage)

[goanpeca]

Area: observability (transport/client)

There is no debug-logging, tracing, or metrics hook. Credential hygiene is good (SSE-C redaction, no key logging), but a consumer debugging a stuck transfer, retry storm, or auth loop has no built-in signal beyond reading source.

Acceptance criteria:

• Optional injectable logger / event hook on B2Client (request/response/retry/reauth lifecycle)
• Guarantee credentials, auth tokens, and SSE-C keys are never emitted (extend the existing redaction tests to cover the hook)

Filed from the production-readiness assessment.