Do not log the Fever API key on authentication failure (#9468)

## Problem

``p/api/fever.php`` logs the full Fever API key on every authentication failure:

```php
Minz_Log::warning('Fever API: wrong credentials! ' . $feverKey .
    ' ; Remote IP address=' . Minz_Request::connectionRemoteAddress(), API_LOG);
```

The Fever key is the user's equivalent API password and it does not expire, so it lands in ``data/users/<user>/log_api.txt`` (written at the default production log level) where anyone with log read access can harvest it. Failed-auth attempts are exactly the case where the submitted credential should never be persisted — this looks like a leftover from before the earlier log-scrubbing pass (#5001).

## Fix

Keep the remote IP address (useful for brute-force monitoring) but drop the key from the message. One-line change; no behavior change otherwise.

p/api/fever.php

@@ -188,8 +188,8 @@ final class FeverAPI
 				Minz_Log::error('Fever API: Please reset your API password!');
 				Minz_User::change();
 			}
-			Minz_Log::warning('Fever API: wrong credentials! ' . $feverKey .
-				' ; Remote IP address=' . Minz_Request::connectionRemoteAddress(), API_LOG);
+			Minz_Log::warning('Fever API: wrong credentials! Remote IP address=' .
+				Minz_Request::connectionRemoteAddress(), API_LOG);
 		}
 		return false;
 	}