pub fn redact_credential(value: &str) -> String
Mask a credential for display, showing only first/last 4 chars.