pub fn redact_secrets(input: &str) -> String
Replace credential-shaped substrings while preserving surrounding context.