feat(secrets): webhook URL and git tokens sealed; run output masks its secrets (#5037)

#5037 "Secrets at rest and in run output: webhook URL and git token
encrypted, askpass via env, secret values scrubbed from logs".

- webhook.url joins SECRET_KEYS; existing values are sealed at startup by
  migrate_plaintext_secrets. Settings -> Notifications no longer echoes the
  URL: it names the saved host, keeps it when left blank, and has a Remove
  box.
- Git source http_token is sealed inside ansible.sources on save and at
  startup, opened in get_sources, and counted by the undecryptable-secrets
  scan as ansible.sources[<name>].http_token.
- The askpass script holds no token: git runs it with STEWARD_GIT_TOKEN in
  its environment and printf prints it as data.
- The executor masks every secret the run is handed (become/vault
  passwords, bootstrap passwords, sensitive run vars, and the per-host agent
  tokens the host_agent plugin now passes as redact) in each line before it
  is broadcast, logged or stored.
- Bundled "Write agent config" tasks are no_log; a test fails if any bundled
  task templating steward_token lacks it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

plugins/host_agent/routes.py

@@ -959,6 +959,7 @@ async def deploy_via_ansible():
         playbook_path="host_agent/install.yml",
         inventory_content=inventory_content,
         inventory_scope=scope,
+        redact=list(tokens.values()),
         # extra-vars outrank the playbook's `vars:` defaults; token stays per-host.
         params={"extra_vars_map": {"steward_url": url, "agent_interval": interval}},
         triggered_by=session.get("user_id"),
@@ -1036,6 +1037,7 @@ async def provision_via_ansible():
         playbook_path="host_agent/provision.yml",
         inventory_content=inventory_content,
         inventory_scope=scope,
+        redact=list(tokens.values()),
         # extra_vars_map → a JSON -e @file: highest precedence (beats play vars)
         # and space-safe (steward_pubkey carries a comment with a space).
         params={"extra_vars_map": {