auth: the duplicate-cookie line hides a link's token (audit A4)

Security audit 2026-10-17, finding A4 (low), stage 0. The line logged when
a request carries two unprefixed session cookies printed r.URL.Path raw,
so GET /confirm/<token> wrote the token to the log (reachable only with
PANEL_COOKIE_SECURE=false, where a sibling host can plant the bare name).
loggedPath moves from internal/web to internal/web/auth as LoggedPath
(web imports auth, not the other way) and both lines - the origin check's
refusal and the duplicate-cookie one - go through it.

Tests: TestDuplicateCookieLineHidesALinksToken; TestLoggedPathHidesTokens
moved with the function. go test ./internal/web ./internal/web/auth.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/auth/loggedpath_test.go

@@ -0,0 +1,19 @@
+package auth
+
+import "testing"
+
+// A rejected request's path is logged without the token of a link
+// (security review, 2026-10-17).
+func TestLoggedPathHidesTokens(t *testing.T) {
+	for in, want := range map[string]string{
+		"/login/reset/abcDEF123": "/login/reset/…",
+		"/confirm/abcDEF123":     "/confirm/…",
+		"/login/reset":           "/login/reset",
+		"/confirm/":              "/confirm/",
+		"/account/profile":       "/account/profile",
+	} {
+		if got := LoggedPath(in); got != want {
+			t.Errorf("LoggedPath(%q) = %q, want %q", in, got, want)
+		}
+	}
+}