Address review findings F1-F4 for config and /health

- F1: read the secret from MEALQUEST_SECRET_KEY_FILE, the documented name.
- F2: reject public URLs carrying userinfo, never echo the raw URL in
  config errors, and log only the public origin (scheme + host).
- F3: validate the MEALQUEST_HTTP_ADDR port (numeric, 0-65535) during Load.
- F4: return 405 with the API error JSON shape for unsupported methods.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cmd/server/main.go

@@ -46,12 +46,7 @@ func run(cfg config.Config, logger *slog.Logger) error {
 
 	errc := make(chan error, 1)
 	go func() {
-		logger.Info("listening",
-			"addr", cfg.HTTPAddr,
-			"public_url", cfg.PublicURL.String(),
-			"data_dir", cfg.DataDir,
-			"version", version,
-		)
+		logListening(logger, cfg)
 		errc <- srv.ListenAndServe()
 	}()
 
@@ -72,3 +67,14 @@ func run(cfg config.Config, logger *slog.Logger) error {
 	}
 	return nil
 }
+
+// logListening logs the startup line. Only the public URL's origin is logged
+// so no credential-bearing URL component can reach the log.
+func logListening(logger *slog.Logger, cfg config.Config) {
+	logger.Info("listening",
+		"addr", cfg.HTTPAddr,
+		"public_origin", cfg.PublicOrigin(),
+		"data_dir", cfg.DataDir,
+		"version", version,
+	)
+}