feat(controller): redact secrets in log API responses

[OnlyTerp]

Summary

• Adds controller/src/core/log-redaction.ts with conservative patterns for bearer tokens, API keys, HF/OpenAI/Anthropic env tokens, generic *_API_KEY/*_TOKEN, JSON-ish secret pairs, CLI flag secrets, and URL query secrets.
• Applies redaction only at GET /logs/:sessionId and GET /logs/:sessionId/stream response boundaries.
• Preserves raw log files on disk; no UI, logger-format, or metrics-parsing changes.
• Complements fix(core/http): filter sensitive data from logs and allow unauthenticated health checks #85 by redacting log content as it crosses API/SSE response boundaries rather than changing controller log-file writes.

Verification

• bun test tests/controller/integration/log-redaction.test.ts — 14 pass, 0 fail
• npm --prefix controller run typecheck
• npm --prefix controller run lint

Known upstream check

• npm run check:contracts currently fails on current main with duplicate AggregatedSession exports in frontend/src/app/api/agent/sessions/all/route.ts and frontend/src/features/agent/session-contracts.ts; this PR does not touch those files.

Notes / Non-goals

• No UI redesign or WP-001 error-card/deep-link work.
• No mutation of raw disk logs or controller logger format.
• No change to llama.cpp/vLLM metrics parsing.