fix: redact handler stats URLs and report stream consumption honestly

[ernolf]

• fix: redact credentials from logged handler stats URLs
• fix: derive stream consumption from EOF and report detached bodies as unknown

Redacts url and redirect_url in the curl handler stats before they reach the log (they bypassed redactUri() and leaked e.g. Google secret iCal hashes), derives stream_consumed from the read position instead of an explicit close(), and reports detached bodies (stream => true consumers like the webcal service) as unknown instead of claiming 0 bytes read.