test: avoid secret-like fixture keys

[flowylife]

Purpose

Avoid secret-scanner false positives before public repository sharing by replacing test fixture strings that looked like real API keys.

Changes

• Replace sk-shaped fixture values with non-secret-looking redacted placeholders.
• Preserve the tests that verify API key handling and provider switching behavior.

Verification

• npm run compile && node --test test/ai-provider.test.mjs test/ui-project-lifecycle.test.mjs
• Secret-like token grep returned no matches for common token patterns.
• git diff --check

Risk Areas

• DB schema changed: No
• API contract changed: No
• Auth/permission changed: No
• UI layout changed: No
• State management changed: No
• Data import/export changed: No
• Build/deployment config changed: No
• Test coverage changed: No

Merge Note

This PR is safe to merge after CI passes.