Stop httpx logging API keys in plaintext

httpx logs every request at INFO as a full URL including the query string, so
the Google Maps key appeared in c2-core's container logs on every geocode call
-- `?address=Holland+Station&...&key=AIza...`. Anyone who can read the logs, or
who is pasted a few lines of them, has the key. It was found exactly that way
while checking why the map was empty.

Nothing in this service needs per-request client logging; callers already log
their own failures with context. httpx and httpcore drop to WARNING, so real
transport errors still surface and the URLs stop being printed.

This does not un-leak the existing key -- it is in the container's log history
and has to be rotated in GCP separately.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

drb-c2-core/app/internal/logger.py

@@ -7,4 +7,12 @@ logging.basicConfig(
     handlers=[logging.StreamHandler(sys.stdout)],
 )
 
+# httpx logs every request at INFO as a full URL *including the query string*,
+# which puts API keys in plaintext in container logs — the Google Maps key was
+# leaking on every geocode call (`?address=...&key=AIza...`). Nothing here needs
+# per-request client logging, so drop httpx to WARNING; failures still surface
+# because the callers log their own errors.
+logging.getLogger("httpx").setLevel(logging.WARNING)
+logging.getLogger("httpcore").setLevel(logging.WARNING)
+
 logger = logging.getLogger("drb-c2-core")