Function redact_credential 

pub fn redact_credential(value: &str) -> String

Mask a credential for display, showing only first/last 4 characters.

Counts characters, not bytes: byte slicing at fixed offsets panics on any multi-byte credential, and this runs on error/log paths where a panic is the worst possible outcome.