Session tokens in /audio/<token>/<id> must not appear in log bundles. Port of the remaining delta of 9aab6233 (pr/605) onto current pre-release: add redact_media_uri() to media_server.rs and redact the URL in the three handle_request logs (request, 404 parse, 403 token mismatch). The device.rs side and the CSPRNG tokens already landed via PR #586. km