feat: secret scanner — auto-detects and redacts API keys, tokens, credentials

Adds a secret scanning layer that runs after identity/explicit
substitutions. Catches secrets the user didn't configure:

- API keys: OpenAI (sk-), Anthropic (sk-ant-), Google (AIza),
  AWS (AKIA), GitHub (ghp_), GitLab (glpat-), Slack (xox),
  Stripe (sk_live/test), SendGrid (SG.)
- Auth: Bearer tokens, key=value assignments (password=, secret=,
  api_key=, token=), private key blocks (-----BEGIN PRIVATE KEY-----)
- Connection strings: mongodb://, postgres://, mysql:// with creds
- PII: SSN (xxx-xx-xxxx), credit card numbers (Visa/MC/Amex/Discover)

Redacted values shown in red in the Test tab. Secrets are truncated
in the activity log (first 8 chars + "...") to avoid logging the
full secret. Enabled by default, toggle in Options.

https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw

src/options/options.js

@@ -11,6 +11,7 @@ document.addEventListener('DOMContentLoaded', async () => {
 
   // Apply settings to UI
   $('#showHighlights').checked = settings.showHighlights || false;
+  $('#secretScanning').checked = settings.secretScanning !== false;
   $('#maxLogEntries').value = settings.maxLogEntries || 200;
 
   renderMappings();
@@ -28,6 +29,10 @@ document.addEventListener('DOMContentLoaded', async () => {
     await Storage.saveSettings({ showHighlights: e.target.checked });
   });
 
+  $('#secretScanning').addEventListener('change', async (e) => {
+    await Storage.saveSettings({ secretScanning: e.target.checked });
+  });
+
   $('#maxLogEntries').addEventListener('change', async (e) => {
     await Storage.saveSettings({ maxLogEntries: parseInt(e.target.value, 10) || 200 });
   });