Sanitize provenance and support authenticated source URIs

[CraigMyles]

Summary

• Keep the full source URI only for reads; use a credential-free canonical URI in store metadata, receipts, output identity, info output, and captured command provenance.
• Redact secret CLI option values and authenticated URLs from success and failure paths, including non-FileNotFoundError CLI errors.
• Support query-authenticated HTTP(S) OME-Zarr stores by attaching the original raw query to every metadata and chunk request.
• Keep remote manifest sharding stable when credentials rotate, while preserving the existing local-path and file:// behaviour.

Compatibility

Unauthenticated remote URIs remain byte-for-byte unchanged. For authenticated remote URIs, semantic selectors (for example version, generation, series, and fragments) remain part of identity, but credentials do not.

Query credentials must authorize the Zarr prefix and its child objects. A presigned URL for a single S3/GCS object will not generally authorize an entire Zarr hierarchy.

Validation

• ruff check .
• focused provenance/URI/OME-Zarr regressions: 69 passed
• full non-slow, non-network Spark suite: 392 passed, 87 deselected
• uv lock --check
• loopback HTTP integration requiring the exact raw query on metadata and chunk requests

Regenerating uv.lock also reconciled pre-existing optional-extra metadata drift.

Refs #6