fix: redact provider-prefixed secret fields in API responses

[codebeetl]

Summary

• Follow-up to feat: opt-in redaction of secret-bearing fields in API responses #38 (opt-in redaction). Related to compose.one (and likely other read endpoints) return env vars in plaintext, leaking secrets into LLM context #41.
• redactSensitive() matched field names by exact equality only. Dokploy's actual API responses prefix git-provider credential fields with the provider name (githubClientSecret, githubPrivateKey, githubWebhookSecret, and the gitlab/bitbucket/gitea equivalents), so none of them match the bare names in DEFAULT_REDACTED_FIELDS (clientSecret, privateKey, secret).
• Result: even with DOKPLOY_REDACT_ENV=true, compose.one (and any other endpoint returning a connected git provider) still returns the provider's client secret, private key, and webhook secret in plaintext.
• Fix: match a field name if it equals or ends with one of the configured redacted field names, so provider-prefixed variants are caught without needing to enumerate every provider explicitly. DOKPLOY_REDACT_ENV's default is untouched (still opt-in, off by default) to avoid changing behavior for existing deployments.

Test plan

• pnpm type-check
• pnpm test (25/25 passing)
• Verified against a live compose.one response containing a real GitHub App githubPrivateKey/githubClientSecret/githubWebhookSecret — confirmed unredacted before this change, redacted after

[Siumauricio]

Pushed a maintainer commit on top, @codebeetl — the fix itself is unchanged: it adds a test suite for redactSensitive covering the provider-prefixed fields from #65 (githubPrivateKey, githubClientSecret, githubWebhookSecret), nesting, arrays, case-insensitivity, null passthrough, circular structures, and prototype-pollution keys, and hoists the lowered suffix list out of the per-key loop. All tests pass. Thanks for the fix — good catch on the exact-match gap.

Complementary: #69 flips DOKPLOY_REDACT_ENV to default-on, which together with this PR fully addresses the MCP side of #65.