fix(documents): redact credentials in settings debug

[chaliy]

What changed

DocumentConversionSettings Debug output now redacts present Cloudflare tokens, including compact/pretty formatting, clones and the original settings after build(). Absent tokens remain None; other settings remain visible.

The public Option<String> field, build/clone behavior and backend feature independence remain intact. No dependency or CI changes. Public hardening docs, the tool contract, TM-LEAK-007 and changelog explain the guarantee and its limits.

Why

Derived Debug formatted the original settings credential even though the separately constructed converter used SecretString. Addresses the representation gap in commit:a2704abae78081919df0555d41941d95.

This is a conditional library diagnostic concern. The report does not establish a default CLI/MCP/Python logging sink or unauthorized production diagnostic reader. Direct field access and arbitrary downstream logging remain caller-controlled.

Before / After

Tiny inert public-API formatting contract on base 3ea92653:

assertion failed: output.contains("<redacted>")
test result: FAILED. 0 passed; 2 failed

Same contract after repair, across default, no-default, Cloudflare-only and docs-all configurations:

test result: ok. 2 passed; 0 failed

Offline public-API smoke after build() and clone:

cloudflare_api_token: Some("<redacted>")
PASS: compact/pretty settings and clone after offline build; field preserved

Only dummy settings used; no live Cloudflare request or credential inspection. Contract also verifies absent/empty tokens and noncredential visibility.

Validation: unchanged workspace tests (including the two ordinary public-network CLI tests), strict clippy, warning-free docs, release build, release CLI help, formatter, both knowledge linters and eight repository-script tests passed. Scoped source/security/design review completed.

Risk

• Low. Only the settings Debug representation changes; callers comparing Debug text will see the redaction marker.
• Redaction is not memory erasure or a global sanitizer. Direct token field formatting, credentials placed in other fields and arbitrary service response text are outside its scope.

Checklist

• Unit tests are passed
• Smoke tests are passed
• Documentation is updated
• Knowledge is up to date and not in conflict