🔒️ fix: redact Authorization header in debug transport output

[kwent]

Summary

• Security audit found that --debug mode dumps raw Authorization: Bearer <token> to stderr via httputil.DumpRequestOut, leaking API keys and OAuth tokens in CI logs and log aggregation systems.
• Fix clones the request before dumping and replaces the auth header with Bearer [REDACTED]. The real token is still sent to the server unchanged.
• Adds 3 regression tests covering redaction, preserved auth on the wire, and no-auth-header behavior.

Test plan

• TestDebugTransportRedactsAuthorization — raw token absent, [REDACTED] present in stderr
• TestDebugTransportPreservesActualAuthHeader — server receives real token
• TestDebugTransportNoAuthHeader — no spurious redaction without auth header
• Full test suite passes (486 tests)

[greptile-apps]

Greptile Summary

This PR redacts Authorization values from debug HTTP request output. The main changes are:

• Clone requests before creating debug output.
• Replace the logged Authorization value with Bearer [REDACTED].
• Avoid reading the original request body during logging.
• Add tests for redaction, wire behavior, and missing headers.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.

Important Files Changed

Filename	Overview
internal/api/client.go	Debug logging now uses a cloned request with a redacted Authorization header and no body.
internal/api/client_test.go	Tests cover redaction in debug output, unchanged outgoing authorization, and requests without authorization.

_{Reviews (2): Last reviewed commit: "🐛 fix: prevent body consumption and fix..." | Re-trigger Greptile}

[kwent]

@greptileai