fix(appraisal): reject credentials embedded in RPC URLs

[s6pa1rta3n-lab]

Summary

Rejects HTTP and HTTPS RPC URLs containing embedded username or password credentials when parsing appraisal API configuration, preventing sensitive credential leakage through diagnostics or configuration copying.

Closes #257

Changes

• Updated parseRpcUrl in services/appraisal-api/src/config.ts to inspect url.username and url.password and throw an AppraisalConfigError with message "must not contain credentials".
• Added unit tests in services/appraisal-api/src/config.test.ts to verify rejection of URLs with username, password, or both, while verifying that credentials are not echoed in error messages.
• Added valid HTTP RPC URL control test cases to ensure normal HTTP and HTTPS behavior remains intact.

Verification

• pnpm --filter @sub-rosa/appraisal-api test (Passes all 42 tests across 9 suites)
• pnpm --filter @sub-rosa/appraisal-api typecheck (Passes with 0 type errors)

Payout Routing

• EVM (Base/Arbitrum/Polygon/ETH): 0xF46C9F6d70C50BF81ef3588AB523a90a594a2F89
• Stellar: GCL6OXAMLD75BMTINA6EMRUDWK5THQUSHMYNLSNBCJAPZJHNYJTUNIBC