fix(logging): structured logging: mask API params, strip token from query string in access logs