Request log: a hook's secret is masked in uvicorn's lines and the tunnel connector's failure line

docs/reference/node-types.md

@@ -83,6 +83,10 @@ publishes nothing.
     Through the [portal](../interface/portal.md#hooks-and-agents-through-the-portal)
     a webhook or served socket answers only with a secret.
 
+The secret is part of the URL of a webhook or a served socket. The engine's own
+request log prints it as `***` (and the last path segment of a hook without
+one), while a reverse proxy in front of the engine logs the path as it sees it.
+
 ### WebSocket
 
 **`websocket`** — listen on a socket, or send to it, as a client or a server.