feat(export): extend --redact-secrets coverage for application keys

[hugomelendez]

Proposed change

Extend --redact-secrets to close credential gaps in shared exports: redact provider_verification_key, client_id, and app_id; strip embedded credentials from OIDC issuer URLs while keeping host/path visible; fail export when cleartext remains after redaction.

Type of change

• New feature

RHCL checklist

• Tests added or updated (go test ./...)
• CI does not introduce -DskipTests without justification
• No secrets in diff (tokens, kubeconfigs, OIDC secrets)
• rhcl-ai docs updated if export/import contract changes
• PR description and docs in English

Test plan

• go test ./internal/export/...
• go test ./... (coverage 80.7%)
• TestExportRedactSecrets — extended keys, issuer strip, auth flags preserved
• TestExportWithoutRedactPreservesSecrets — opt-in default (no flag)
• TestVerifyNoCleartextSecretsFailsWithPath — gate fails with path-qualified error

Additional information

• Related: SDD change extend-redact-secrets

[fmenesesg]

Review summary

Solid extension of --redact-secrets — closes realistic gaps for shared exports without changing the opt-in default.

What works well

• Redacts provider_verification_key, client_id, and app_id in JSON/YAML artifacts
• Strips embedded credentials from issuer_endpoint / oidc_issuer_endpoint while preserving host/path
• Preserves auth-mode proxy flags (auth_user_key, auth_app_id, auth_app_key)
• Post-redaction gate (VerifyNoCleartextSecrets) fails export with a path-qualified error before manifest.json is written
• Good test coverage: opt-in default preserved, end-to-end export path, unit tests for JSON/YAML, README + TC-EXP-003 updated

Verified locally: go test ./... — 165 tests pass.

Nit (non-blocking): YAML issuer URLs wrapped in quotes are not stripped by stripURLUserinfo (quotes break url.Parse), but the verify gate still detects userinfo and fails the export — safe fail-closed behavior. Consider trimming quotes in a follow-up if toolbox YAML commonly uses quoted issuers.

Behavior note for team: exports with --redact-secrets may now fail where they previously completed with residual cleartext — intentional and desirable for shared artifacts.

Approve — ready to merge.