RedactUpstream keeps a path-based credential in the upstream URL display

[harshaneel]

Found during review of the request-logging PR (#19), but the issue is in already-merged code, so filing separately.

Problem

RedactUpstream (internal/server/server.go) strips userinfo and query/fragment from an upstream URL before it is logged or returned in the /health body, but it keeps the path. If an operator uses a path-based credential in LK_UPSTREAM, for example:

LK_UPSTREAM=https://gateway.internal/tenants/sk-live-abc123/v1

then the credential in the path survives redaction and appears in:

• the startup log line (localaik: upstream https://gateway.internal/tenants/sk-live-abc123/v1 (LK_UPSTREAM))
• the /health 503 body when the upstream is unreachable, which is returned to any unauthenticated caller

Likelihood

Low. Most OpenAI-compatible servers authenticate via a header (Authorization, api-key), which is why LK_UPSTREAM_AUTH_HEADER exists. Path-based credentials are uncommon but not unheard of (some gateways embed a key or tenant token in the path).

Options

1. Reduce the redacted display to scheme + host only, dropping the path. Simplest, and the path is rarely load-bearing for a human reading a log. Downside: a legitimate base path like /v1 disappears from the display, which is mildly useful context.
2. Keep the path but document that credentials belong in LK_UPSTREAM_AUTH_HEADER, not the URL.
3. Leave as-is; the header is the supported credential channel and this is an unusual misuse.

Note the request path logged by the new access log (r.URL.Path) is the client's request path, not the upstream URL, and is separately sanitized in #19. This issue is only about the upstream URL display.