fix(security): stop httpx from logging GNEWS_API_KEY in plaintext

httpx logs every request URL at INFO level, and the GNews search URL
carries the API key as a `?token=` query param, so GNEWS_API_KEY was
written in plaintext into the pod logs on every news query. Raise the
httpx/httpcore loggers to WARNING so request URLs never reach INFO.

The bot's own GNews log lines only print the sanitised keyword query
(NewsClient._build_query), never the token, so they are unaffected.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

bot/main.py

@@ -27,6 +27,12 @@ logging.basicConfig(
     level=logging.INFO,
     format="%(asctime)s [%(levelname)s] %(name)s: %(message)s",
 )
+# httpx logs every request URL at INFO, and the GNews URL carries the API key as
+# a `?token=` query param — that would leak GNEWS_API_KEY in plaintext into the
+# pod logs.  Raise httpx/httpcore to WARNING so request URLs never reach INFO.
+# The bot's own GNews log lines only print the sanitised query, not the token.
+logging.getLogger("httpx").setLevel(logging.WARNING)
+logging.getLogger("httpcore").setLevel(logging.WARNING)
 log = logging.getLogger("bot.main")
 
 PAPER_MODE = os.getenv("PAPER_MODE", "true").lower() == "true"