milestone 13 discrepancies: redact credentials from urls in logs, metrics and cli output

docs/tutorial/first-run.md

@@ -71,9 +71,9 @@ an install decision, not a first-run decision. A real install is covered in
 The `default` group and one enabled upstream are the two things nxdns will not
 start without. Every client that nxdns has never seen is assigned to `default`,
 and with no usable upstream there is nowhere to send a query it cannot answer
-itself, so a configuration missing either one is rejected. Seeding happens
-inside `run`, so `run` prints the problem and exits 1; `nxdns check` and `nxdns
-import` reject the same file with exit code 2.
+itself, so a configuration missing either one is rejected. Whichever command
+reads the file says the same thing and stops the same way: `run`, `nxdns check`
+and `nxdns import` all print the problem and exit 2.
 
 ## 4. Check the configuration before starting
 
@@ -83,13 +83,14 @@ zig-out/bin/nxdns check --data-dir ~/nxdns-tutorial/data --config ~/nxdns-tutori
 
 ```
 checking configuration file /home/you/nxdns-tutorial/config.zon
-OK https://cloudflare-dns.com/dns-query
+OK upstreams[0] https://cloudflare-dns.com
 OK: no problems found
 ```
 
 `check` parses the file, validates it, and contacts each upstream to confirm it
-answers. It exits 0 when there is nothing to fix and 2 when there is. It does
-not start any listener, so you can run it as often as you like.
+answers. It exits 2 when it found something that has to be fixed and 0
+otherwise. It writes nothing and starts no listener, so you can run it as often
+as you like.
 
 ## 5. Start the server
 
@@ -158,6 +159,13 @@ separate decision, which is what lets one group get a strict list and another
 get none. A source that is attached to no group is downloaded and then filters
 nothing.
 
+You are in that state right now, between the previous step and this one, and it
+is legal rather than wrong — creating a source and attaching it afterwards is
+the normal order, which is why the API accepted it without complaint. On a
+stopped server `nxdns check` names such a source in a `WARN` line and still
+exits 0, so a list that silently blocks nothing is something you can find out
+about later. Attaching it now is what makes it take effect.
+
 Ask which groups exist:
 
 ```sh