fix(security): redact sensitive values in browse storage command

[HMAKT99]

The bug

$B storage dumps all localStorage and sessionStorage as raw JSON. This appears in QA reports, agent transcripts, and contributor logs — exposing tokens, API keys, JWTs, and session credentials.

# Current behavior:
$B storage
{
  "localStorage": {
    "authToken": "eyJhbGciOiJIUzI1NiIs...",     ← exposed
    "stripe_pk": "pk_live_abc123...",              ← exposed
    "theme": "dark"                                 ← fine
  }
}

# After this fix:
$B storage
{
  "localStorage": {
    "authToken": "[REDACTED — 128 chars]",
    "stripe_pk": "[REDACTED — 24 chars]",
    "theme": "dark"
  }
}

The fix

Redact values where:

• Key matches: token, secret, key, password, auth, jwt, csrf, api_key
• Value starts with: eyJ (JWT), sk- (Stripe/OpenAI), ghp_ (GitHub PAT), xoxb- (Slack), Bearer

Redacted output shows length for debugging: [REDACTED — 128 chars]

Non-sensitive values (theme, language, sidebar_collapsed) pass through unchanged.

1 file changed, 15 lines

Only browse/src/read-commands.ts modified. No other files touched.

Test plan

• All 407 existing tests pass
• bun run gen:skill-docs --dry-run — FRESH
• Sensitive key patterns redacted
• Sensitive value prefixes (JWT, API keys) redacted
• Non-sensitive values unchanged

[garrytan]

Merged into #325 (wave 1: /cso launch + security hardening). Thank you for the contribution!