Implement a privacy logger

backend/cmd/server/main.go

···
 	"margin.at/internal/api"
 	"margin.at/internal/db"
 	"margin.at/internal/firehose"
+	internalMiddleware "margin.at/internal/middleware"
 	"margin.at/internal/oauth"
 	"margin.at/internal/sync"
 )
···
 
 	r := chi.NewRouter()
 
-	r.Use(middleware.Logger)
+	r.Use(internalMiddleware.PrivacyLogger)
 	r.Use(middleware.Recoverer)
 	r.Use(middleware.RequestID)
 	r.Use(middleware.RealIP)

backend/internal/middleware/logger.go

···
+package middleware
+
+import (
+	"log"
+	"net/http"
+	"net/url"
+	"time"
+
+	"github.com/go-chi/chi/v5/middleware"
+)
+
+func PrivacyLogger(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		ww := middleware.NewWrapResponseWriter(w, r.ProtoMajor)
+		t1 := time.Now()
+
+		defer func() {
+			safeURL := redactURL(r.URL)
+
+			log.Printf("[%d] %s %s %s",
+				ww.Status(),
+				r.Method,
+				safeURL,
+				time.Since(t1),
+			)
+		}()
+
+		next.ServeHTTP(ww, r)
+	})
+}
+
+func redactURL(u *url.URL) string {
+	redacted := *u
+	q := redacted.Query()
+
+	sensitiveKeys := []string{"source", "url", "target", "parent", "root", "uri"}
+
+	for _, key := range sensitiveKeys {
+		if q.Has(key) {
+			q.Set(key, "[REDACTED]")
+		}
+	}
+
+	redacted.RawQuery = q.Encode()
+	return redacted.String()
+}