fix(scan): strip query strings from scanned URLs in logs - #136

Scanned URLs were logged in full, so a scanned reset link or signed URL put its token in the logs. They're now logged as origin and path only. The query string, the # fragment and any user:password@ part are all dropped.

https://me:pw@site.com/reset?token=abc → https://site.com/reset

Where

• scanController.js: the two Received … URL: request log lines.
• scanRunner.js: the structured scan log from feat(scan): structured logging for scans (URL, duration, violations, error class) #130. The redaction runs inside logScan, so every scan log line gets it.
• Also fixed: the structured log's error field. Puppeteer's navigation errors quote the full URL (net::ERR_NAME_NOT_RESOLVED at https://…?token=…), so failed scans would still have leaked the token.

Both use one small pure module, services/redactUrl.js:

• safeUrl(url): origin + path.
• scrubUrls(text): applies safeUrl to every URL inside free text.

Tests

• Unit tests for redactUrl.
• Controller test: request log lines never contain the token.
• Structured-log test: a URL with a token, a fragment and credentials, run through both a successful and a failed scan.
• One existing assertion changed: URLs are now normalized, so https://example.com logs as https://example.com/.

Not covered: tokens inside the path itself (e.g. /reset/<token>) are still logged, because the issue asks to keep the path.

Closes #132