feat: add secrets redaction patterns for MongoDB URI, Google credentials, and common patterns

[charannyk06]

Priority: P3 — Low

Problem

src/server/tools/redact.ts has good coverage for common secrets (AWS keys, JWT tokens, GitHub tokens, npm tokens, Slack tokens) but is missing patterns for several common credential types:

• MongoDB connection strings (mongodb+srv://user:pass@cluster...)
• Google/GCP service account JSON keys
• Docker Hub tokens
• Twilio auth tokens
• SendGrid/Mailgun API keys
• Database URLs (PostgreSQL, MySQL with credentials)

Solution

Add additional regex patterns to the redaction tool:

// MongoDB connection strings
/mongodb(\+srv)?:\/\/[^:]+:[^@]+@[^\s"']+/gi,

// PostgreSQL/MySQL connection strings with credentials  
/postgres(ql)?:\/\/[^:]+:[^@]+@[^\s"']+/gi,
/mysql:\/\/[^:]+:[^@]+@[^\s"']+/gi,

// Google service account keys (JSON pattern)
/"private_key":\s*"-----BEGIN (RSA )?PRIVATE KEY-----[^"]+"/gi,
/"client_email":\s*"[^@"]+@[^.]+\.iam\.gserviceaccount\.com"/gi,

// Twilio
/SK[0-9a-fA-F]{32}/g,  // Twilio auth tokens

// Generic high-entropy string detection (optional, with false-positive tuning)

Test coverage

Add tests in src/server/__tests__/security.test.ts for each new pattern.

Note on false positives

Be conservative — it's better to occasionally miss a secret in a test file than to redact legitimate code strings. Consider a // chainreview:noredact comment to opt out of redaction for a line.

Acceptance Criteria

• MongoDB URI pattern added and tested
• PostgreSQL/MySQL with credentials pattern added
• Google service account key detection
• Each new pattern has a unit test
• No false positives on legitimate code strings