fix: redact credentials in database connection URLs

[varshith84]

Closes #6.

Redact the username/password portion of PostgreSQL, Redis, and MySQL URLs in both mask and hash modes, retaining their scheme, host, port, and database path. Passwordless URLs remain intact, including user@host forms that would otherwise match the email rule. Update both README languages and regenerate the tracked bundle.

Validation:

• npm run doctor: all checks passed
• npm test: 219 passed
• npm run typecheck, npm run bundle, and git diff --check: passed
• New fixtures cover each scheme, empty usernames, encoded credentials, IPv6 hosts, punctuation, multiple occurrences, and passwordless URLs. The credential fixtures failed before the rule was added.

This is pattern-based best-effort redaction, consistent with the existing API. Prepared with Codex assistance.