security(tests): remove hardcoded API token from test file

[Snider]

Parent audit: #36

Finding

A hardcoded API token exists in the test file, which could be a real credential committed to version control.

Location

• src/Mod/Trees/Tests/Unit/AgentDetectionTest.php

Fix

Replace the hardcoded token with an environment variable lookup or a fake/mock token that is clearly not a real credential.

Acceptance Criteria

• No real API tokens in test files
• Token sourced from environment variable or replaced with an obviously fake value
• If the token was real, it has been rotated/revoked
• CI pipeline passes with the updated approach

[Snider]

Parent: #104