fix: close CodeQL clear-text-logging alert (no API-key substrings)

[askalf]

Summary

First CodeQL alert against the public repo. High severity, js/clear-text-logging, sink at src/util/output.ts:8 (the success() logger). Closes the alert by removing the upstream substring exposure and breaking the dataflow on the second flagged path.

Two upstream paths flagged

1. Real (low-but-nonzero) info disclosure — src/auth.ts:90-91

hands auth status line emitted sk-ant-...XXXX (first 7 + last 4 chars of the stored API key):

const masked = config.apiKey.slice(0, 7) + '...' + config.apiKey.slice(-4);
output.success(`Mode: API Key (${masked})`);

The first 7 chars are the well-known fixed sk-ant- prefix (zero entropy), but the last 4 are real key material. Anthropic API keys are long-lived; emitting any substring to a place that ends up in screenshots / pasted bug reports / shared terminal scrollbacks widens the exposure surface for no operational benefit.

Fixed: display *** only. Matches dario v3.7.2+'s "no substring of any stored key in user-facing output" rule. The user-visible behavior is now Mode: API Key (***).

2. CodeQL false-positive (cleanly resolved) — src/init.ts:93

output.success(`auth: ${config.authMode}${config.authMode === 'api_key' && config.apiKey ? ' (key stored)' : ''}`);

The template's true-branch is the literal string ' (key stored)' — config.apiKey's value is never emitted, only its truthy-ness is consumed. But CodeQL's js/clear-text-logging dataflow conservatively flags any access on a path that ends at a logger, so it tracks config.apiKey through the ternary into the template into success().

Fixed: route through a Boolean(...) intermediate so the flow stops there. Behavior unchanged — same string emitted in the same conditions.

const keyStored = config.authMode === 'api_key' && Boolean(config.apiKey);
output.success(`auth: ${config.authMode}${keyStored ? ' (key stored)' : ''}`);

Test plan

• npm run typecheck — clean.
• npm run build — clean.
• npm test — 36/36 pass; no test referenced the masked format, so no test fix needed.
• Required CI checks (actionlint, analyze / CodeQL, build (20/22)) on this PR.
• CodeQL alert auto-dismisses after merge — analyze job re-runs on the merged commit, sees the dataflow is gone, and closes alert ci: foundation parity with dario / claude-bridge / deepdive #1.