Redact sensitive query parameters

[terjekv]

Summary

• include sensitive query parameter values in the shared request-secret redaction set
• redact those values from both API response diagnostics and pre-response transport failures
• add equivalent synchronous and asynchronous regression coverage
• document the expanded exception-safety guarantee

Why

Request URLs stored on public exceptions are already query-free, but the outgoing query values were not part of the redaction set. A transport exception that included the original request URL, or an API error that echoed a value under a name such as api_key or token, could therefore expose that secret.

The fix normalizes all accepted request parameter forms through HTTPX's query representation and collects values only for names already classified as sensitive.

Impact

There is no request API change. Error diagnostics now replace sensitive query values with <redacted>, matching the existing handling for authorization headers and secret-bearing request bodies.

Verification

• uv sync --extra dev
• uv run ruff format --check .
• uv run ruff check .
• uv run mypy
• uv run bandit -q -r src scripts
• uv run zizmor .
• uv run pytest --cov — 69 passed, 95.63% coverage
• uv run mkdocs build --strict
• uv build

The local Docker daemon was unresponsive, so the pinned Hubuum v0.0.3 e2e job in this PR's CI is the live-server verification authority.