fix(diagnostics): stop redacting non-secret config field names

`doctor --issue` and the dashboard config dump were wrongly redacting
config fields whose names happened to contain a credential-shaped word
as a substring. Examples from real bug reports:
  - "pin_key_files": "<REDACTED:pin_key_files>"
  - "token_budget": "<REDACTED:token_budget>"
  - "nudge_interval_tokens": "<REDACTED:nudge_interval_tokens>"
  - "injection_budget_tokens": "<REDACTED:injection_budget_tokens>"
  - "execute_threshold_tokens": "<REDACTED:execute_threshold_tokens>"

Root cause: `isSecretKey` used a bare substring regex
`/(?:key|token|secret|password|auth|bearer|credential)/i` against the
field name. Any compound containing those words matched, regardless of
whether the field actually holds a credential.

Replaced with segment-aware matching:
  - split the name on `_`, `-`, `.`, and camelCase boundaries
  - find a "secret-word" segment (key/token/secret/password/auth/
    authorization/bearer/credential, with optional trailing `s`)
  - require a leading "qualifier" segment (api, access, private,
    client, auth, authorization, secret, bearer, session, refresh,
    service, x, openai, anthropic, google, github, huggingface,
    aws, azure) — so `api_key` redacts but `key_files` does not
  - allow trailing descriptors (id, value, header, plural forms) —
    so `aws_access_key_id` redacts
  - bare singletons (`key`, `token`, `password`, `authorization`,
    etc.) still redact unconditionally because HTTP header object
    field names show up that way

Test coverage:
  - 35-entry SHOULD_REDACT list covers AWS, OpenAI, Anthropic,
    GitHub, Azure, Google, generic auth/refresh/session/bearer/private
    naming conventions
  - 11-entry SHOULD_NOT_REDACT list locks in all the false-positive
    config field names from the Magic Context schema
  - 4 sanitizeConfigValue scenarios verifying nested configs preserve
    siblings while still redacting embedding.api_key

Verification: 124 CLI tests pass (up from 122 prior), typecheck, lint,
build clean. No plugin- or pi-side changes; same shared redaction
module used everywhere.