fix: redact API keys in debug config logging

Prevent clear-text logging of OPENAI_API_KEY and ANTHROPIC_API_KEY
in the debug configuration output. CodeQL flagged this as a high
severity security issue.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: Mossaka

src/cli.ts

@@ -1035,6 +1035,8 @@ program
     const redactedConfig = {
       ...config,
       agentCommand: redactSecrets(config.agentCommand),
+      openaiApiKey: config.openaiApiKey ? '[REDACTED]' : undefined,
+      anthropicApiKey: config.anthropicApiKey ? '[REDACTED]' : undefined,
     };
     logger.debug('Configuration:', JSON.stringify(redactedConfig, null, 2));
     logger.info(`Allowed domains: ${allowedDomains.join(', ')}`);