fix(api): access log keeps the mcp path but not its query, the token rode in it

backend/src/api/access_log.py

@@ -0,0 +1,19 @@
+import logging
+
+QUERYLESS_PREFIXES = ("/mcp",)
+_PATH_ARG = 2
+
+
+class DropQueryFilter(logging.Filter):
+    def filter(self, record: logging.LogRecord) -> bool:
+        args = record.args
+        if isinstance(args, tuple) and len(args) > _PATH_ARG:
+            path = str(args[_PATH_ARG])
+            if path.startswith(QUERYLESS_PREFIXES):
+                bare = path.partition("?")[0]
+                record.args = (*args[:_PATH_ARG], bare, *args[_PATH_ARG + 1 :])
+        return True
+
+
+def hide_mcp_query() -> None:
+    logging.getLogger("uvicorn.access").addFilter(DropQueryFilter())