Function mask_key 

pub fn mask_key(key: &str) -> String

Masks an API key showing only the first 12 and last 4 characters.

Example: ctx7sk-abc123...xyz9

If the key is too short (≤ 16 Unicode characters), returns *** for protection. Uses chars() for UTF-8 safety — avoids panics from byte-indexing multibyte characters.