====================================================================================================
### Requirement: Mask sensitive config values in CLI output
The system SHALL mask values for config keys matching `api_key`, `token`, or `secret` (case-insensitive) when displaying them via `config set`, `config list`, or `config get`. Masked format: `****<last 4 chars>` (or `****` if value is ≤4 chars).
#### Scenario: config set echoes masked value
- **WHEN** user runs `config set ai.api_key "sk-abc123def456"`
- **THEN** stdout shows `****f456` not the full key
#### Scenario: config list masks api_key
- **WHEN** user runs `config list`
- **THEN** the `api_key` field displays `****<last4>` instead of the plaintext value
#### Scenario: short secret is fully masked
- **WHEN** the api_key value is 3 characters
- **THEN** the display shows `****`