fix(config): redact URL secrets structurally via the url crate

[mfw78]

What

Replace the hand-rolled path-segment redact_url heuristic with a structural redactor built on the url crate. It blanks userinfo, query strings, fragments, and long API-key path segments before an RPC url reaches a log line.

Why

Closes #44

The previous heuristic only split on / and rewrote long path segments, so it leaked secrets that do not live in the path: a bare query flag (?token), a ?key=secret query value, and a #fragment bearer token all sailed through untouched. Parsing with url::Url and clearing each credential-bearing component closes those gaps, and an unparseable url now yields a <unparseable-url> placeholder rather than being logged verbatim.

Credit to @jean-neiverth, who raised #44 (originally via #163).

Testing

cargo test -p nexum-runtime --lib redact (9 cases: userinfo, query value, bare ?token flag, #fragment, @-in-path, long path segment -> KEY, clean url intact, unparseable -> placeholder).
cargo clippy -p nexum-runtime --all-targets -- -D warnings, cargo fmt --all.

AI Assistance

AI Assistance: Claude (Opus) used for extracting the redactor and its tests, and drafting this PR.