feat: mask secret values in the UI and redact them from diagnostics

- Env/header values whose key looks secret (TOKEN, API_KEY, PASSWORD,
  AUTH, ...) render as •••••••• via a display-only delegate; a
  'Show secrets' toggle reveals them. Underlying data, editing, and
  save are untouched.
- The Add dialog switches the value field to password echo when the
  key name looks secret.
- Copy-diagnostics now redacts secrets from args (--token <v>,
  --api-key=<v>, and well-known token prefixes like ghp_/sk-/xoxb-),
  since those reports get pasted into public bug reports. Env and
  header values were already omitted from diagnostics.

tests/test_core.py

@@ -176,7 +176,52 @@ def test_valid_set_passes_clean():
 
 
 # --------------------------------------------------------------------------- #
-# 5. Dependency / PATH checking
+# 5. Secrets: detection + redaction
+# --------------------------------------------------------------------------- #
+def test_is_secret_key_positives():
+    for k in (
+        "BRAVE_API_KEY",
+        "BEARER_TOKEN",
+        "password",
+        "GH_TOKEN",
+        "Authorization",
+        "client_secret",
+        "PRIVATE_KEY",
+        "aws_access_key_id",
+    ):
+        assert c.is_secret_key(k), k
+
+
+def test_is_secret_key_negatives():
+    for k in ("JOOMLA_BASE_URL", "PORT", "HOME", "PATH", "debug", "TIMEOUT"):
+        assert not c.is_secret_key(k), k
+
+
+def test_redact_args_flag_value():
+    assert c.redact_args(["--token", "abc123", "run"]) == ["--token", c.MASK, "run"]
+
+
+def test_redact_args_inline_flag():
+    assert c.redact_args(["--api-key=abc123"]) == [f"--api-key={c.MASK}"]
+
+
+def test_redact_args_known_prefix():
+    assert c.redact_args(["ghp_abcdef123456"]) == [c.MASK]
+
+
+def test_redact_args_leaves_normal_args():
+    args = ["--directory", "/path/to/server", "run", "main.py", "-y"]
+    assert c.redact_args(args) == args
+
+
+def test_diagnostics_redacts_token_args():
+    txt = c.diagnostics_text("t", {"command": "npx", "args": ["--token", "s3cret-value"]})
+    assert "s3cret-value" not in txt
+    assert c.MASK in txt
+
+
+# --------------------------------------------------------------------------- #
+# 6. Dependency / PATH checking
 # --------------------------------------------------------------------------- #
 def test_dep_check_finds_python3():
     assert c.check_dependency({"command": "python3"})["status"] == "ok"