Expand daemon credential-redaction regression coverage

[ocularminds]

Context

The daemon handles organization API keys and a one-request account credential exchange. Security guarantees require these values never to appear in logs, responses, or persisted state.

Scope

Add adversarial regression tests around every credential-handling and error path.

Acceptance criteria

• Tests inject recognizable sentinel secrets into connect, enrollment, retry, timeout, and malformed-response paths.
• Captured logs and HTTP responses contain none of the sentinel values.
• Account passwords are absent from persisted settings after success and failure.
• Stored API key files retain the documented restrictive permissions.
• The tests run in CI and fail with a redacted diagnostic.