fix(security): deep-redact --debug logs, rotate debug files, guard unhandled rejections

[cdot65]

Summary

Hardens the --debug fetch interceptor. Previously only authorization/x-pan-token headers were masked — and kept an 8-char prefix — while request/response bodies and query params were written to ~/.prisma-airs/debug-api-*.jsonl unredacted, and files accumulated forever.

Changes

• Recursive body redaction (request + response) for credential-like keys (token|secret|password|credential|authorization|cookie|api[-_]?key)
• Query-param redaction in logged URLs; response headers now redacted too
• Sensitive headers fully masked (***) — no prefix retained
• Debug files rotated: newest 10 kept, older pruned on install
• New src/cli/process-guards.ts: unhandledRejection → friendly stderr message + exit 1
• Docs: scanning.md debug section documents scrubbing + rotation

Testing

• 12 new unit tests (redaction fns, pruning, interceptor integration with mocked fetch, process guards)
• Full suite 640/640; lint + tsc clean

Checklist

• TDD (failing tests committed first)
• All gates pass locally
• Docs updated
• Changeset added (patch)

Closes #265