fix: scope backup_diff to server sections and mask secrets

The diff preview in RestoreDialog was serializing the full config dict,
exposing secret env values and token args in cleartext on a pasteable surface.

- Add _redact_server_data / _redact_servers_block helpers that apply
  redact_args to args and mask env values for is_secret_key() keys
- Rewrite backup_diff to compare only {mcpServers, _disabledMcpServers}
  sections (sanitized), not the whole file — also avoids double-serializing
  multi-MB ~/.claude.json for a servers-only diff
- Add clarifying comment in _restore_from_backup about why full_config
  is the right base after confirm-discard
- Add test: backup_diff with secret args/env → MASK in output, raw values absent
- Add test: restore_backup restores _disabledMcpServers correctly

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

bcc.py

@@ -1646,6 +1646,8 @@ class MainWindow(QMainWindow):
             return
         if self.dirty and not self._confirm_discard():
             return
+        # full_config is the right base: discarded edits were server changes;
+        # non-server keys from the in-memory state are what we want to preserve.
         dlg = RestoreDialog(self, self.current_profile, self.full_config)
         if not dlg.exec():
             return