fix(video): keep signed stream tokens out of logs and traces

The access log and the tracing root span's http.target both recorded the
full /video/original/stream?token=… URL, i.e. a credential for a
possibly sensitive file, in the journal and OTel exports. An outermost
middleware now moves the token into request extensions and rewrites the
URI to token=redacted before either logger sees it; the handler reads
the token from extensions and fails closed (401) without the middleware.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/main.rs

@@ -318,6 +318,11 @@ fn main() -> std::io::Result<()> {
                 .wrap(middleware::Logger::default())
                 .wrap(cors)
                 .wrap(tracing_actix_web::TracingLogger::default())
+                // Outermost: strips signed stream tokens from the URI before
+                // either logger above records it.
+                .wrap(middleware::from_fn(
+                    handlers::video::redact_original_stream_token,
+                ))
                 .service(
                     web::resource("/login")
                         .wrap(Governor::new(&governor_conf))