Address review findings F1-F4 for config and /health

- F1: read the secret from MEALQUEST_SECRET_KEY_FILE, the documented name.
- F2: reject public URLs carrying userinfo, never echo the raw URL in
  config errors, and log only the public origin (scheme + host).
- F3: validate the MEALQUEST_HTTP_ADDR port (numeric, 0-65535) during Load.
- F4: return 405 with the API error JSON shape for unsupported methods.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cmd/server/main.go

@@ -46,12 +46,7 @@ func run(cfg config.Config, logger *slog.Logger) error {
 
 	errc := make(chan error, 1)
 	go func() {
-		logger.Info("listening",
-			"addr", cfg.HTTPAddr,
-			"public_url", cfg.PublicURL.String(),
-			"data_dir", cfg.DataDir,
-			"version", version,
-		)
+		logListening(logger, cfg)
 		errc <- srv.ListenAndServe()
 	}()
 
@@ -72,3 +67,14 @@ func run(cfg config.Config, logger *slog.Logger) error {
 	}
 	return nil
 }
+
+// logListening logs the startup line. Only the public URL's origin is logged
+// so no credential-bearing URL component can reach the log.
+func logListening(logger *slog.Logger, cfg config.Config) {
+	logger.Info("listening",
+		"addr", cfg.HTTPAddr,
+		"public_origin", cfg.PublicOrigin(),
+		"data_dir", cfg.DataDir,
+		"version", version,
+	)
+}

cmd/server/main_test.go

@@ -0,0 +1,34 @@
+package main
+
+import (
+	"bytes"
+	"log/slog"
+	"net/url"
+	"strings"
+	"testing"
+
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/config"
+)
+
+func TestLogListeningOmitsURLCredentials(t *testing.T) {
+	t.Parallel()
+
+	// Load rejects such URLs; this proves the log stays safe even if one
+	// reached the Config some other way.
+	u, err := url.Parse("https://alice:hunter2@meals.example.com/app?token=t0ken")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var buf bytes.Buffer
+	logListening(slog.New(slog.NewJSONHandler(&buf, nil)), config.Config{HTTPAddr: ":8080", PublicURL: u})
+
+	out := buf.String()
+	for _, leak := range []string{"alice", "hunter2", "t0ken"} {
+		if strings.Contains(out, leak) {
+			t.Errorf("startup log leaks %q: %s", leak, out)
+		}
+	}
+	if !strings.Contains(out, `"public_origin":"https://meals.example.com"`) {
+		t.Errorf("startup log missing public origin: %s", out)
+	}
+}