redactCredentialText covered authorization, bearer, cookie, API-key,
token, and sk- shapes only, so CLI errors such as 'login failed:
password=hunter2' reached the UI verbatim via boundedCliMessage and
Diagnostics. Extend the key pattern with password, secret,
private_key, and client_secret (with -/_/space variants), keeping the
existing quoted/JSON/escaped value handling.

Add QtTest coverage for bare, quoted, and JSON password/secret shapes.