### Check for existing issues

- [x] I have searched the existing issues and checked that my issue is not a duplicate.

### What happened?

`StandardLoggingMetadata.user_api_key_hash` is emitted into long-lived logging sinks (e.g. the S3 request/response logs). It is meant to hold a **hash** of the virtual key, never the key itself. But both functions that build the standard logging metadata blind-copy `user_api_key_hash` verbatim from the caller's input metadata, so a **raw** `sk-...` virtual key (or a JWT) placed in that field is persisted in cleartext.

`user_api_key_hash` is a `StandardLoggingMetadata` field (`litellm/types/utils.py`), so it is included in the key set that both builders copy directly from input metadata:

`litellm/litellm_core_utils/litellm_logging.py` — `StandardLoggingPayloadSetup.get_standard_logging_metadata` (~line 4690):

```python if isinstance(metadata, dict): for key in metadata.keys() & _STANDARD_LOGGING_METADATA_KEYS: clean_metadata[key] = metadata[key] # type: ignore # <-- copies user_api_key_hash verbatim

user_api_key = metadata.get("user_api_key") if user_api_key and isinstance(user_api_key, str) and is_valid_sha256_hash(us…