fix: redact database credentials from exception logs

[suguanYang]

Summary

• redact PostgreSQL URL credentials from standard log messages before they reach Loguru/Logfire
• prevent Logfire from exporting exception messages and stack traces that contain database URL credentials
• add contract coverage for URL masking and exception suppression
• related to the production DSN exposure observed during retrieval failures and complements PR perf: persist map-nav scoring index for large corpora #344

Verification

• PYTHONPATH=apps/api:packages/shared-python /home/suguan/github.com/ontosAI/knowhere/.venv/bin/pytest -q apps/api/tests/contract/test_logging_security_contract.py
• PYTHONPATH=apps/api:packages/shared-python /home/suguan/github.com/ontosAI/knowhere/.venv/bin/pytest -q apps/api/tests/contract/test_dashboard_jwt_authentication_contract.py::test_logfire_exception_callback_downgrades_auth_exceptions_by_status apps/api/tests/contract/test_logging_security_contract.py
• Ruff format and check passed for changed files.

Deployment Notes

• no environment variables, migrations, queues, storage, or API contracts changed
• deploy the application image normally; the protection applies to both API and worker logging setup
• database credential rotation remains a separate operator action and should be performed because credentials were previously exposed
• exceptions containing PostgreSQL URL credentials remain recorded as error-level spans without the raw exception payload, preserving operational signal without exporting the secret

Checklist

• Tests were added or updated when behavior changed
• Public docs, examples, or OpenAPI contracts were updated when needed
• Database migrations are idempotent and safe to deploy (no migration changed)
• Logs, errors, and validation paths avoid leaking secrets or user data
• The pull request description explains any breaking or user-visible change