p2.5: log host=- for permit_restricted callers

Scrape, fetch, refused, fetch-failed, and internal lines redact the
host for callers in context.permit_restricted. final_url stays in the
response. Test captures slog records, not the journal.

internal/api/api.go

@@ -42,6 +42,9 @@ type Server struct {
 	SelfIP  *selfip.Discoverer
 	Digest  *digest.Engine
 	Ctx     *fleetctx.Client
+	// PermitRestricted is context.permit_restricted: those callers never
+	// have a fetch host written to the log (host=-). Independent of Honcho.
+	PermitRestricted []string
 
 	global chan struct{}
 	perMu  sync.Mutex
@@ -206,7 +209,7 @@ func (s *Server) scrape(w http.ResponseWriter, r *http.Request) {
 	}
 	rawTok := len(res.Body) / 4
 	retTok := len(md) / 4
-	s.Log.Info("scrape", "caller", c.Name, "host", hostOf(res.FinalURL), "status", res.Status, "bytes", len(res.Body))
+	s.Log.Info("scrape", "caller", c.Name, "host", s.logHost(c, res.FinalURL), "status", res.Status, "bytes", len(res.Body))
 	writeJSON(w, 200, map[string]any{
 		"success": true,
 		"data": map[string]any{
@@ -348,7 +351,7 @@ func (s *Server) v1fetch(w http.ResponseWriter, r *http.Request) {
 			fb = s
 		}
 	}
-	s.Log.Info("fetch", "caller", c.Name, "host", hostOf(res.FinalURL), "mode", mode,
+	s.Log.Info("fetch", "caller", c.Name, "host", s.logHost(c, res.FinalURL), "mode", mode,
 		"q_len", qLen, "raw_tokens", len(res.Body)/4, "returned_tokens", len(content)/4,
 		"digest_ms", digestMS, "fallback", fb)
 
@@ -487,7 +490,7 @@ func (s *Server) writeFetchErr(w http.ResponseWriter, c *auth.Caller, rawURL str
 	if c != nil {
 		name = c.Name
 	}
-	host := hostOf(rawURL)
+	host := s.logHost(c, rawURL)
 	var fe *fetch.Error
 	if errors.As(err, &fe) {
 		if fe.Status == 403 {
@@ -568,6 +571,26 @@ func hostOf(raw string) string {
 	return u.Hostname()
 }
 
+func permittedCaller(name string, permit []string) bool {
+	if name == "" {
+		return false
+	}
+	for _, p := range permit {
+		if p == name {
+			return true
+		}
+	}
+	return false
+}
+
+// logHost is the host field for request logs. permit_restricted callers get "-".
+func (s *Server) logHost(c *auth.Caller, raw string) string {
+	if c != nil && permittedCaller(c.Name, s.PermitRestricted) {
+		return "-"
+	}
+	return hostOf(raw)
+}
+
 func writeErr(w http.ResponseWriter, status int, msg, hint string) {
 	if status == 502 {
 		status = 500