security: redact API keys from settings debug logs

[SAKURA-CAT]

Problem

Settings.load_api_key() logs the complete .netrc result:

console.debug(f"Loaded credentials: {netrc_result}")

The tuple contains (api_key, api_host, web_host). When SWANLAB_DEBUG=true, console.debug() writes the value to the terminal and the internal diagnostic log buffer, which may later be flushed to debug.log. This exposes the full API key in plaintext logs.

This is independent of PR #1723 and should be fixed separately.

Reproduction

Use a fake key in .netrc, enable SWANLAB_DEBUG, and construct Settings or call a settings-dependent API. The debug output contains the fake key in the Loaded credentials message.

Expected behavior

Credential loading logs may record the source or host, but must never include the API key or other secret values.

Suggested fix

• Remove the raw netrc_result from the debug message, or redact the API key before logging.
• Add a regression test asserting that a fake key is absent from terminal output and diagnostic logs.

Acceptance criteria

• No API key appears in stdout, stderr, or debug.log when SWANLAB_DEBUG=true.
• Credential source/host diagnostics remain available without exposing secrets.
• A regression test covers .netrc credential loading.