fix(core): redact URL userinfo credentials in shared redactors

[Rangsh]

Summary

Shared redactors in @maka/core already masked URL query secrets (?token=…) but left URL userinfo credentials (https://user:pass@host/…) intact unless the secret happened to match a fixed provider prefix such as ghp_. That leak showed up in ordinary shell output (git remote -v, push/fetch errors) via shell-run-manager and pty-screen-collector.

This PR adds a structural userinfo step to both redaction.ts and display-redaction.ts (before the query-secret step): for each https?:// authority that contains @, replace everything through the last @ with the redaction marker while preserving host and path. No provider-prefix list is required. The display pattern also declares streamingTerminator / streamingValueGroup so streaming-suffix redaction keeps its contract.

Fixes #4593

Verification

• npm --workspace @maka/core run build
• node --test packages/core/dist/__tests__/redaction.test.js packages/core/dist/__tests__/display-redaction.test.js — pass
• npm --workspace @maka/core run test:dist — 798 pass / 0 fail
• npm --workspace @maka/ui run build
• node --test packages/ui/dist/__tests__/streaming-display-redaction.test.js — 15 pass / 0 fail

Not run: full monorepo npm test, lint/format/typecheck across unrelated workspaces.

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope:

Cursor (Composer) drafted the userinfo redaction changes in packages/core/src/redaction.ts and packages/core/src/display-redaction.ts, added the covering tests, and prepared the commit/push. Human review and PR submission remain with the author.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No