Function redact 

pub fn redact(key: &str) -> String

Redact a credential for display.

Delegates to leviath_core::secrets::redact, which keeps the last four characters. Showing the first eight would give a different answer from the HTTP logger’s, and keep the wrong half: API keys are structured at the front, so sk-ant-a, sk-proj- and ghp_… identify the issuer and, on a short token, expose a meaningful fraction of the value. A suffix is unstructured and just as good for “is this the key I think it is”.

Kept as a named wrapper rather than replacing every call site, so this module’s UI code reads the same and there is one place to look if the wizard ever needs a different presentation.