feat: warn when a secret-shaped value is found in args instead of env (#1r)

Adds `args_secret_warning(data)` to bcc_core — returns a warning string
when any arg positional value looks like a raw credential (token prefix,
value following a secret-named flag, or URL with embedded user:pass like
postgres://user:pass@host).  `--flag=value` inline forms are intentionally
skipped (the flag name already labels the value).

Adds `secret_warn` QLabel in ServerEditor's stdio page; shown/hidden by
`_check_args()` on every field change, and cleared on deselect or
stdio→remote type switch.  Non-blocking — save path is not touched.

Closes #1

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

bcc.py

@@ -449,6 +449,12 @@ class ServerEditor(QFrame):
         warn_row.addWidget(self.args_warn, 1)
         warn_row.addWidget(self.args_fix_btn)
         v.addLayout(warn_row)
+        # Shown when an arg value looks like a raw credential.
+        self.secret_warn = QLabel("")
+        self.secret_warn.setStyleSheet(f"color: {WARN};")
+        self.secret_warn.setWordWrap(True)
+        self.secret_warn.hide()
+        v.addWidget(self.secret_warn)
         v.addWidget(self._lbl("Environment variables"))
         self.env = KeyValueTable(
             "Variable", "Value", on_change=self._emit, before_change=self._before_change
@@ -495,6 +501,7 @@ class ServerEditor(QFrame):
             self._set_dep({"status": "unknown", "label": "—"})
             self.args_warn.hide()
             self.args_fix_btn.hide()
+            self.secret_warn.hide()
             self._loading = False
             return
         self.setEnabled(True)
@@ -581,6 +588,7 @@ class ServerEditor(QFrame):
         if self.type.currentIndex() != 0:  # stdio page only
             self.args_warn.hide()
             self.args_fix_btn.hide()
+            self.secret_warn.hide()
             return
         _, notes = core.split_suspicious_args(self._current_arg_lines())
         if notes:
@@ -590,6 +598,12 @@ class ServerEditor(QFrame):
         else:
             self.args_warn.hide()
             self.args_fix_btn.hide()
+        warning = core.args_secret_warning({"args": self._current_arg_lines()})
+        if warning:
+            self.secret_warn.setText("⚠  " + warning)
+            self.secret_warn.show()
+        else:
+            self.secret_warn.hide()
 
     def _fix_args(self):
         if self._before_change: