Download addresses lose their query before they go out (#292)

Progress and DownloadDone went to every open page and the log with the
file's whole address; a Patreon file's carries its signature. Seen in
production's log for gcn-news-minute.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

crates/ipx/src/ipc.rs

@@ -236,7 +236,10 @@ impl Event {
                 *url = redact(url);
                 *msg = redact_text(msg);
             }
-            Event::TorrentDeferred { url, .. } => *url = redact(url),
+            // Progress and DownloadDone too: a Patreon file's address carries its signature (#292).
+            Event::TorrentDeferred { url, .. } | Event::Progress { url, .. } | Event::DownloadDone { url, .. } => {
+                *url = redact(url)
+            }
             Event::FeedMoved { from, to, .. } => {
                 *from = redact(from);
                 *to = redact(to);
@@ -486,8 +489,23 @@ mod tests {
             from: format!("https://x/rss?{key}"),
             to: format!("https://y/rss?{key}"),
         });
-        // What every open page is sent, whoever's feed it is (#238).
+        out.emit(Event::Progress {
-        for _ in 0..3 {
+            feed: "f".into(),
+            enclosure: 1,
+            url: format!("https://cdn/ep.mp3?{key}"),
+            file: "ep.mp3".into(),
+            done: 1,
+            total: None,
+        });
+        out.emit(Event::DownloadDone {
+            feed: "f".into(),
+            enclosure: 1,
+            url: format!("https://cdn/ep.mp3?{key}"),
+            path: "/downloads/ep.mp3".into(),
+            bytes: 1,
+        });
+        // What every open page is sent, whoever's feed it is (#238, #292).
+        for _ in 0..5 {
             let sent = serde_json::to_string(&rx.try_recv().unwrap()).unwrap();
             assert!(!sent.contains("SECRET"), "{sent}");
             assert!(sent.contains("https://"), "the address is still there, without its key: {sent}");