demo-ui: keep sandbox credentials server-side and add safe environment controls

[teesofttech]

Why

A provider test console can easily become a credential-exfiltration tool or accidentally make live charges. Security constraints must be designed before UI implementation.

Scope

• Load credentials only from server-side secret stores/environment.
• Add explicit Mock/Sandbox/Live mode policy; disable Live by default.
• Require authentication and authorization for hosted/non-local deployments.
• Add rate limits, anti-forgery protections, secure headers, and audit logs.
• Redact request/response data and define retention.

Acceptance criteria

• Secrets never appear in HTML, JavaScript, browser storage, API responses, logs, or telemetry.
• Live mode cannot be enabled by a browser request alone.
• Hosted console requires approved access.
• Security tests cover CSRF, XSS, injection, authorization, and redaction.
• Threat model is reviewed before public deployment.