Stop Apache writing the server's token into its access log

/audio/ URLs carry the token as a query parameter, because a URL handed to a downloader has to be
usable as it stands, and the "combined" log format logs %r -- the whole request line. So every
audio fetch wrote the token in plaintext into a file logrotate keeps fourteen copies of: 335 lines
across fifteen files, going back months.

Both vhosts now use a listen_noquery format, %m %U %H instead of %r, which keeps the method, path
and protocol and drops the query. Verified with a canary token against the live server rather than
by reading the config: the request logged as "GET /api/health HTTP/1.1" with nothing after it, and
a real request from the phone logged cleanly alongside it. The existing logs are redacted in place,
gzipped ones included, with their lines and timestamps intact -- zero occurrences left, and none
anywhere else under /var/log.

The token itself is worth rotating, since it sat in those files for months. That is Peter's call.

The real fix is for the audio URL to carry no token, which needs the downloader sending a bearer
header for skip-server hosts -- and only those, or the token would go to every podcast CDN it
fetches from. That app change has to be installed before the server stops emitting the query
token, so it is not in this one.

Config only; no code changed. Written up in CLAUDE.md so nobody restores "combined".

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018AwnALZL6bD4VBtATDVv3B

0 files changed, 0 insertions, 0 deletions