Redact sensitive FreshRSS login failure logs

[Skulldorom]

Motivation

• Prevent sensitive data from being emitted when FreshRSS login fails by avoiding logging the upstream response body and configured credentials while retaining minimal diagnostic metadata.

Description

• Replace the failed-login log line to only include the HTTP status and the parsed upstream hostname using urlsplit in main.py.
• Remove logging of the upstream response body and any credentials or tokens from the warning path in get_greader_token().
• Add a caplog regression test test_get_greader_token_rejects_failed_login_without_logging_secrets in tests/test_main.py that asserts the status and upstream host are present in logs and that sentinel credentials, response body, and token values are never logged.

Testing

• Ran the project test suite via the project runner with uv run pytest -q, which completed successfully with 9 passed.
• Running pytest -q directly in the environment failed during collection due to fastapi not being installed globally, which is an environment issue and not related to the changes.
• Ran git diff --check to validate the diff for formatting issues and it reported no problems.

---

Codex Task

[Skulldorom]

Superseded by #25 — all four PRs merged with conflict resolution and review fixes applied.