Keep query-string tokens out of the uvicorn, nginx and Traefik access logs

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ

frontend/nginx.conf

@@ -1,5 +1,21 @@
+# The live socket carries its credential as `?token=`, and so does a password
+# reset link, which then rides along as the Referer of everything that page
+# loads. nginx's own format logs both as sent; this one masks the value.
+map $request $request_masked {
+  "~^(?<request_head>.*?[?&][\w-]*token=)[^&\s]*(?<request_tail>.*)$" "${request_head}***${request_tail}";
+  default $request;
+}
+map $http_referer $referer_masked {
+  "~^(?<referer_head>.*?[?&][\w-]*token=)[^&\s]*(?<referer_tail>.*)$" "${referer_head}***${referer_tail}";
+  default $http_referer;
+}
+log_format masked '$remote_addr - $remote_user [$time_local] "$request_masked" '
+                  '$status $body_bytes_sent "$referer_masked" '
+                  '"$http_user_agent" "$http_x_forwarded_for"';
+
 server {
   listen 80;
+  access_log /var/log/nginx/access.log masked;
 
   # nginx's mime.types predates the manifest, so without this it goes out as
   # application/octet-stream.