Keep query-string tokens out of the uvicorn, nginx and Traefik access logs

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ

docker/compose.dev.yml

@@ -21,6 +21,7 @@ services:
       - --entrypoints.http.address=:80
       - --entrypoints.https.address=:443
       - --accesslog
+      - --accesslog.fields.queryparameters.defaultmode=drop
       - --log
       - --log.level=DEBUG
       - --api

docker/compose.traefik.yml

@@ -57,6 +57,9 @@ services:
       - --certificatesresolvers.le.acme.tlschallenge=true
       # Enable the access log, with HTTP requests
       - --accesslog
+      # Without query strings: the live socket and a worker's attach carry their
+      # token there, and Traefik can drop query values but not mask them
+      - --accesslog.fields.queryparameters.defaultmode=drop
       # Enable the Traefik log, for configurations and errors
       - --log
       # Enable the Dashboard and API