[P2] Strip credentials/paths from endpoint URLs used as metric labels and in logs #49

Priority: P2 (security) · Effort: S

Problem

Endpoint URLs are used verbatim as metric label values and in logs:

• endpoint and target_endpoint labels in drift (--reference-node, --full-nodes)
• consensus RPC endpoints in balance
• startup logs

Provider URLs often embed API keys (for example https://…/v2/<KEY>) or userinfo (https://user:pass@host). Those secrets end up in Prometheus, its remote storage, and the logs.

Proposed fix

Add a small helper that keeps only scheme://host[:port] (dropping userinfo, path and query) for labels and logs. Use the full URL only to dial.

Pros / Cons

• ✅ No credential leakage.
• ⚠️ Two endpoints on the same host with different paths would collapse into one label. Accept this, or append a short hash of the path.