fix: security hardening across auth, API, keychain, and error output

[wcole1-godaddy]

Security Hardening

Addresses 8 findings from a security audit of the CLI. 2 high, 4 medium, 2 low severity.

High

• SEC-01: OAuth callback server now binds to 127.0.0.1 instead of 0.0.0.0, preventing LAN-based auth code interception
• SEC-02: --debug output now sanitizes response headers, redacting Set-Cookie, Authorization, and other sensitive headers

Medium

• SEC-03: --include flag now sanitizes response headers before writing them into the JSON envelope on stdout
• SEC-04: OAuth error callback page now HTML-escapes error messages, preventing reflected XSS
• SEC-05: Windows PowerShell keychain escaping hardened — strips NUL bytes, rejects newlines, validates all 4 methods (set/get/delete/find)
• SEC-06: Raw server error payloads no longer forwarded into userMessage fields in JSON envelopes. Affects applications.ts (9 GraphQL catch sites) and webhook-events.ts

Low

• SEC-07: --debug output now redacts sensitive fields (token, secret, password, credential) in request bodies
• SEC-10: OAuth callback server now auto-closes after 120 seconds if the user never completes the browser flow

Not code changes

• SEC-08 (env var redirect) and SEC-09 (-F file read) are by-design behaviors, documented only

Files changed

• src/core/auth.ts — SEC-01, SEC-04, SEC-10
• src/core/api.ts — SEC-02, SEC-03, SEC-06, SEC-07
• src/cli/commands/api.ts — SEC-03
• src/effect/layers/keychain-native.ts — SEC-05
• src/services/applications.ts — SEC-06
• src/services/webhook-events.ts — SEC-06

Testing

• TypeScript: tsc --noEmit passes
• Build: pnpm run build passes
• Unit tests: 653/654 pass (1 flaky perf test pre-existing)
• CLI smoke: all commands produce correct JSON envelopes