fix(security): redact credentials at every logger transport [skip-bump]

[zaydiscold]

Summary

Hydra currently sends complete proxy credentials through the normal Winston logger during server startup. When HYDRA_DATA_DIR is set, that same message is written into the rotating hydra.log file. Error stacks and structured messages can also carry OpenRouter keys, JWTs, bearer values, or auth cookies into console and support logs.

This PR adds a final redaction boundary shared by every Winston transport.

• redact sk-hydra-*, sk-proj-*, and sk-or-v1-* credentials
• redact JWT-shaped values
• redact Authorization and Proxy-Authorization bearer values
• redact standalone bearer tokens
• redact hydra_token and __session cookies
• apply the same formatting and redaction to console and rotating-file output
• safely stringify non-string log payloads instead of collapsing them to [object Object]

Why this belongs at the logger boundary

Individual call sites should still avoid logging secrets. A final transport-level boundary provides defense in depth for startup messages, imported errors, exception stacks, and future code paths that accidentally include a credential.

The redactor preserves ordinary diagnostics and replaces only known credential shapes. It does not remove ports, account counts, event names, stack context, or error explanations.

Verification

The existing sanitization test now verifies that complete Hydra, generic proxy, OpenRouter, JWT, bearer, and cookie values cannot survive redaction, while ordinary proxy startup diagnostics remain unchanged.

This is a logging-only security fix. It does not change authentication, routing, storage, Electron behavior, API responses, or key derivation. The commit contains [skip-bump] so merging it will not publish a desktop release.