Apply client-side header redaction to CLI event output commands

[codemountains]

Closes #79

Context

Security review finding P6: events stream already redacts sensitive headers client-side via redactHeadersForDisplay, but events show, events latest, and events tail --headers printed headers directly from API responses. This created a defense-in-depth gap and inconsistent operator experience.

Changes

• Add redactEventDetailForDisplay() in apps/cli/src/presentation/output/events.ts and apply it in printEventDetail, printEventHeaders, and --json output paths for events show and events latest.
• Add rawSensitiveEventDetail test fixture with unredacted sensitive headers (including x-barestash-secret).
• Add unit tests in apps/cli/src/presentation/output/events.test.ts and integration tests in apps/cli/src/presentation/commands/events.test.ts covering human and JSON output for show, latest, and tail.

Documentation and contracts

Check anything affected by this PR:

• Product scope, MVP, or positioning in requirements/barestash.spec.md
• CLI commands, flags, output, auth, tokens, endpoints, or events in requirements/barestash-cli-design.spec.md
• Technical design, operations, topology, or runbooks in docs/
• README or onboarding guidance
• Public API, event schema, JSON/JSONL output, or streaming behavior
• No documentation or public contract changes

Behavior now matches the existing CLI design spec and apps/cli/AGENTS.md security rules; no spec updates required.

Security and data handling

• This PR does not include tokens, credentials, private endpoint URLs, captured raw payloads, or user data.
• Raw payloads, headers, logs, errors, and fixtures are redacted or intentionally safe.
• Token secrets are not exposed outside creation-time flows.
• Destructive or remote side effects are documented and require explicit user intent.
• Not applicable.

Verification

pnpm --filter @barestash/cli test   # 78 passed
pnpm --filter @barestash/cli typecheck
pnpm test                           # 219 passed (monorepo)

Skipped checks or residual risk:

• just check was not run because just is unavailable without the Nix dev shell daemon in this environment; monorepo pnpm test and CLI typecheck were run instead.

Review notes

• Redaction uses the shared redactHeadersForDisplay helper, same as events stream (transformStreamPayload).
• x-barestash-secret and x-barestash-bootstrap-token are filtered out entirely (not shown as [REDACTED]).
• JSON output for show/latest now redacts the event object before printing; body content is unchanged.