fix(tracing): capture request paths for unmatched routes

- Record url.path before routing so 404s and early responses retain their path.
- Keep matched route templates as span names to limit cardinality.
- Exclude query strings, full URLs, cookies and authorization headers.
- Test decoded paths on 404 responses and path attributes on matched routes.
- Document that paths may expose filenames, IDs or share tokens.
- Validate NanoShare with 294 passing tests.

tests/test_request_tracing.py

@@ -88,7 +88,7 @@ def test_request_to_worker_to_convex_keeps_trace_and_payload_private(monkeypatch
   assert events[0]["trace_id"] == "1" * 32
   exported = " ".join(str((s.name, dict(s.attributes), s.events, s.status.description)) for s in spans)
   assert "never-export" not in exported
-  assert "private-value" not in exported
+  assert server.attributes["url.path"] == "/items/private-value"
   assert "token=" not in exported
   provider.shutdown()
 
@@ -163,6 +163,31 @@ def test_retry_attempts_get_unique_ids_and_do_not_export_exception_text(monkeypa
   assert clients[0].status.description is None
   provider.shutdown()
 
+def test_unmatched_request_records_path_without_query_or_headers(monkeypatch):
+  provider, exporter = tracing_provider(monkeypatch)
+
+  async def run():
+    app = Quart(__name__)
+    register_request_tracing(app, provider=provider)
+    result = await app.test_client().get(
+      "/missing/%E2%9C%93?token=never-export",
+      headers={"Authorization": "Bearer never-export", "Cookie": "secret=never-export"},
+    )
+    assert result.status_code == 404
+
+  try:
+    asyncio.run(run())
+    span = exporter.get_finished_spans()[0]
+    assert span.attributes["url.path"] == "/missing/✓"
+    assert span.attributes["http.response.status_code"] == 404
+    assert "http.route" not in span.attributes
+    assert span.name == "HTTP GET"
+    assert "never-export" not in str(dict(span.attributes))
+    assert "url.full" not in span.attributes
+    assert "url.query" not in span.attributes
+  finally:
+    provider.shutdown()
+
 def test_invalid_incoming_traceparent_is_not_used(monkeypatch):
   provider, exporter = tracing_provider(monkeypatch)