#165: Redact credentials in passive discovery URLs

[justsml]

Stacked on #164 / PR #150.

Closes #165

Scope

• Unconditionally remove HTTP(S) userinfo and redact sensitive query and fragment values before passive evidence is projected.
• Apply the invariant through shared evidence redaction with passive normalizer defense in depth.
• Preserve non-secret host, path, auth categorization, and evidence attribution.
• Cover response projection, durable report content, and RAG index input, including when general evidence redaction is disabled.

Validation

• 3 focused integration files / 21 tests pass.
• Typecheck and targeted lint pass.
• Diff checks pass.

Merge order

Merge PR #150 first, then retarget this PR to PR #150's base or main.

[justsml]

Council of Dans review: repair/defer. Highest-priority gate: Restack early in the passive slice and prove credentials are absent from response, stored report, Artifact payload, and indexed RAG text. Feature flags are not a substitute for authority, evidence-integrity, or durability fixes; use typed modes only where they provide a real rollout boundary.