fix(mcp): redact secrets from OAuth failure logs

[Aaronontheweb]

Problem

A review of #1969 raised a question: could the new OAuth diagnostic logging
print a secret? The new code does not. It logs only booleans and field
names, never the raw token or client secret value.

The review found a separate, pre-existing gap. McpClientManager logs nine
OAuth-related exceptions directly through ILogger. A token or DCR exchange
failure can carry the provider's raw HTTP error body inside the exception
message, and that body can echo back the client secret or token the request
sent. A log sink prints the full exception text, so a secret could leave the
daemon log. This risk grows when OTLP export sends logs off the box.

A second gap made the fix harder than "add a redact call": SecretOutputRedactor
already redacts secrets in JSON key form ("client_secret": "..."), but its
env-style regex (key=value text) did not match compound keys like
client_secret or refresh_token. Only the JSON regex matched those keys. A
form-urlencoded OAuth error body (client_secret=...&grant_type=...) uses
exactly the compound-key shape the env-style regex missed.

A follow-up check against #1970 (which touches McpOAuthCredentialStore)
found the same shape of gap there: its credentials-file load path also logs
a raw exception. The secrets file is decrypted before that callback runs, so
a malformed-JSON or decryption failure could in principle echo a fragment of
plaintext credential content into the log. #1970's own diff adds no logging
and does not introduce this; it is pre-existing in the file it touches.

Change

• Fix SecretOutputRedactor's env-style regex to match the same compound
  key set the JSON regex already matches.
• Add SecretOutputRedactor.RedactForLogging, a shared helper that swaps in
  a redacted summary only when an exception's rendered text matches a secret
  pattern. The common case (network errors, cancellations, disposal
  failures) keeps its original exception instance, type, and full stack
  trace untouched.
• Route all nine _logger.LogWarning(ex, ...) / _logger.LogError(ex, ...)
  call sites in McpClientManager.cs through it, plus the two in
  McpOAuthCredentialStore.cs.
• Add regression tests for the redactor gap and the logging helper.