security(secrets): redact SDK keys and database credentials from Debug output

[pierrick-fonquerne]

Severity

Medium — accidental credential disclosure through application logs and diagnostics.

Problem

FlapsProviderConfig derives Debug while containing a raw SDK key. The daemon Config also derives Debug while containing a database URL that may embed credentials. Current call sites may avoid logging them, but the public/debuggable types make future accidental disclosure easy.

Affected areas:

• crates/flaps-client/src/provider.rs
• crates/flapsd/src/config.rs

Acceptance criteria

• Secret-bearing configuration types implement redacted Debug or use a dedicated secret wrapper.
• SDK keys, session tokens, passwords, database passwords and HMAC material never appear in Debug or error output.
• Secret fields are private where public mutation is unnecessary and are exposed only through intentional constructors/accessors.
• Cloning and zeroization behavior is documented for secret values.
• Tests format every secret-bearing configuration/error type and assert that sentinel secrets are absent.
• Logging guidance documents safe identifiers such as SDK key prefixes instead of raw keys.