fix(nginx): the live-tail handshake no longer logs the caller's JWT

[JosteinGj]

A browser WebSocket cannot send an Authorization header, so /timeseries/datapoints/listen carries its token in the query string — and datahub_lb logs $request, the whole request line. Every handshake wrote a replayable access token into the api access log in plaintext, valid until it expired.

That location now uses datahub_lb_noquery: the same fields with the request line rebuilt from $uri, which stops at the "?". Both distro variants; the README says what to do about logs already on disk.

What this changes

How it was verified

Checklist

• Pull requests this one depends on are named above and merged first, or there are none
• Commits are signed off (git commit -s), per CONTRIBUTING.md
• ./gradlew build passes
• Behaviour visible outside this repo is reflected in the documentation, or does not need to be
  (see AGENTS.md for which of the two documentation sites it belongs in)