Pass bfabric tus credentials via environment

[Caushi]

Draft until a bfabricpy release containing the linkable handling is out — this pairs with
fgcz/BioBeamer#25, which needs that release before merge.

What this adds

Plumbing so a host using tool="tus" can authenticate to B-Fabric. The launcher stays
transfer-agnostic — it still only reads version from the XML — so this is purely about getting
credentials and the right extra to BioBeamer.

The secret never travels as an argument

The existing password goes through cmd.extend(["--password", ...]) and then
logger.info(f"Running BioBeamer: {' '.join(cmd)}") — i.e. written to the log in plaintext, and
visible in /proc/*/cmdline. Rather than extend that pattern for an OAuth secret, the client secret
is passed through the environment (subprocess.run(..., env=...)), and only the non-secret
settings travel as arguments.

That also fixes the pre-existing leak: redact_command masks the value after --password, so the
existing network password no longer lands in the log either. redact_config does the same for the
config dump, and --debug prints export BFABRIC_CLIENT_SECRET=... instead of the value.

Verified by asserting the secret is absent from the printed config and the logged command line, while
<set> still tells the operator it is configured.

New launcher.ini keys

Key	Meaning
bfabric_base_url	B-Fabric instance URL
bfabric_client_id	OAuth client id of the instrument's service user
bfabric_scope	must include tus — B-Fabric's default scope does not grant it
bfabric_client_secret	prefer the BFABRIC_CLIENT_SECRET env var; an already-set env var wins

Installing the tus extra only where it is needed

extras_for_host returns ["tus"] when the host's tool is tus, so uv pip install -e gets
.[tus] for those hosts and plain . for everyone else. bfabric is a large dependency tree that
requires Python 3.11+, and the robocopy instrument PCs must keep installing.

Note the venv is only built when the entry point is missing, so a host opting into tus needs a new
version value (which yields a fresh BioBeamer-venv-<version>) for the extra to be installed. The
feat-tus-upload branch name serves that purpose during testing.

Also fixed in passing: the venv PATH was joined with a hardcoded : separator, wrong on Windows.

Files

• src/biobeamer_launcher/launcher.py — config keys, env= on the subprocess, redact_config /
  redact_command, extras_for_host, PATH separator
• config/launcher.ini.example — documents the four keys and why the secret belongs in the environment
• tests/conftest.py — the stub BioBeamer must accept the new non-secret flags