The shared credential filter recognized secret= but missed secret_key and secretAccessKey assignments, allowing synthetic credential values into messages, diagnostics and support reports. Extend the existing name matcher and add direct QtTests for each public output path.

Documentation: update Unreleased security notes and usage/development guides. TODO is unchanged because this repairs existing sanitization without adding CLI contracts or parity features.