security: harden probe input/output handling

[muras3]

Summary

• sanitize target output to strip URL userinfo
• reject control characters in --header and constrain --method format
• enforce timeout range (1-300s)
• set HTTP MaxResponseHeaderBytes to 1 MiB
• expand request header redaction list (x-api-key, x-auth-token, set-cookie)
• add agent dashboard/tail scripts for multi-role visibility

Testing

• go test ./...
• go test ./internal/cli ./internal/core ./internal/layers/http -run 'Test(ParseTargetStripsUserInfoFromOriginal|ParseArgsRejectsHeaderControlCharacters|ParseArgsTimeoutRange|NewDefaultSetsResponseHeaderLimit|HTTPRequestHeadersRedaction)' -count=1
• go run ./cmd/probe --json --timeout 1 http://alice:secret@localhost:1