fix(online): Harden login logging and the updater, fix splash focus

[tintinhamans]

Small cleanup pass on login and the updater.

Login and anticheat tokens (and the auth response bodies that carry them) no longer go into the log in release builds, only their size. Debug builds still log the full values, same as the existing HTTP response redaction. That HTTP redaction also lowercased the whole logged response while looking for tokens, so it now checks a lowercase copy instead. The login page link now uses https. One lobby log call passed the response body as the format string, so it now goes in as an argument.

The updater download used the default 5 second request timeout, which is too short for a real download, so it gets a long one. The updater file name from the version check now has to be a bare file name, and the download is saved under that name so the launch step runs exactly the file that was written.

Two follow-ups to last week's changes are in here too. With the separate splash window the game window takes over focus inside the same app, so it never got WM_ACTIVATEAPP and stayed marked inactive (mouse moves ignored) until an alt-tab; it now also picks up activation from WM_ACTIVATE. And during a match, a peer that crashed was re-signalled for the rest of the game; retries now stop once the service drops that player from the lobby.