security: harden credential handling, pipeline JS execution, and the HTTP/stream layer

[lhfer]

Summary

A security review surfaced several issues across credential handling, the pipeline
engine, and the HTTP/stream layer. This PR fixes the cleanly-fixable ones with
regression tests; a few items that need a product/contract decision are listed at
the end rather than changed unilaterally.

Source-only (no dependency changes). vp check is green; unit suites pass
(core 9, cli 81; e2e skipped without an API key).

Fixes

Credential handling

• config set no longer echoes secrets in cleartext. bl config set --key api_key …
  (and access_token/access_key_id/access_key_secret) printed the stored value
  verbatim to stdout — unlike config show/auth status, which mask. The confirmation
  echo now masks secret-valued keys.
• --verbose request logs use maskToken() instead of printing the first 8 chars of
  the bearer token / AccessKey id (http.ts, knowledge retrieve).
• telemetry.jsonl is written 0600 (was default/world-readable).
• ensureConfigDir enforces 0700 via an explicit chmod (mkdir's mode is ignored for
  a pre-existing ~/.bailian that may already hold cleartext credentials).

Pipeline engine

• script/js code must be a literal string. A step's code is a resolved input, so
  it could be written as { $from: <chat-step> } — turning model/API output into the body
  of new Function (untrusted data → arbitrary host code execution). Validation now rejects
  $from/expression-sourced code; authoring a literal script/js step is unchanged.
• --dry-run never executes $js. Planning previously ran no-arg $js via new Function;
  a preview of an untrusted pipeline must not run code. Planning now returns the placeholder.
• getByJsonPointer blocks __proto__/constructor/prototype and only follows own
  properties.
• --concurrency is clamped to 64 to bound fan-out.

HTTP / stream layer

• URL path segments are encodeURIComponent-d: task_id (from the server's async-submit
  response, fetched back with the bearer token attached) plus app_id/node_id/schema_id.
• SSE parser buffer is bounded (16 MiB) against streams with no newline / one giant event.
• base_url / console_gateway_url are validated as real http(s) URLs via new URL,
  replacing a startsWith("http") check that also accepted e.g. httpfoo://….

Not changed here (maintainer decision)

• script/js / $js runtime still uses new Function (full host authority). With the
  literal-code rule, untrusted data can no longer become the code body; remaining exposure
  is authored code (the file is the trust boundary). Stronger isolation is a product call.
• base_url host allow-listing — would break proxy/self-host users.
• --console loopback callback (wildcard CORS, token via GET query, no Host check, state
  embedded in the notice param) — hardening depends on the console server contract.
• Credential precedence: a config.json key silently overrides DASHSCOPE_API_KEY.
• Telemetry derives a persistent device_id from the MAC address and forwards raw error
  messages to gm.mmstat.com (default-on; DO_NOT_TRACK=1 opts out).

Testing

• vp check: pass · core 9 tests pass · cli 81 tests pass (48 e2e skipped)
• New regression tests cover every fix above.