fix: sanitize import job summaries

tests/test_auto_import_failure_boundaries.py

@@ -202,6 +202,48 @@ def test_import_job_public_payload_hides_database_error(monkeypatch, tmp_path):
         session.close()
 
 
+def test_import_job_public_payload_hides_import_summary_internals(monkeypatch, tmp_path):
+    import_service = _load_import_service(monkeypatch, f"sqlite:///{tmp_path / 'momo.db'}")
+    import_service.Base.metadata.create_all(import_service.engine)
+
+    service = import_service.ImportService()
+    job_id = service.create_import_job("daily_sales", "drive-file-1", "daily.xlsx", 1024)
+
+    session = import_service.Session()
+    try:
+        job = session.query(import_service.ImportJob).filter_by(id=job_id).one()
+        job.status = "completed"
+        job.import_summary = json.dumps({
+            "imported_count": 42,
+            "table_name": "daily_sales_snapshot",
+            "synced_to": "realtime_sales_monthly",
+            "sync_success": True,
+            "sync_error": None,
+            "verified": True,
+            "date_min": "2026-06-24",
+            "date_max": "2026-06-25",
+            "source_sheet": "即時業績明細",
+            "source_header_row": 1,
+            "message": "成功匯入 42 筆資料，已同步至業績分析儀表板",
+        }, ensure_ascii=False)
+        job.local_file_path = "data/temp/daily.xlsx"
+        session.commit()
+    finally:
+        session.close()
+
+    public_job = service.get_job_status(job_id)
+    public_text = json.dumps(public_job, ensure_ascii=False)
+
+    assert public_job["import_summary"]["imported_count"] == 42
+    assert public_job["import_summary"]["sync_status"] == "已更新業績分析儀表板"
+    assert "daily_sales_snapshot" not in public_text
+    assert "realtime_sales_monthly" not in public_text
+    assert "table_name" not in public_text
+    assert "synced_to" not in public_text
+    assert "drive-file-1" not in public_text
+    assert "local_file_path" not in public_text
+
+
 def test_google_drive_auth_refuses_browser_without_json_token(monkeypatch, tmp_path):
     import services.google_drive_service as google_drive_service