fix: key slash encoding on route, redact more request secrets, bound JSON depth and uploads

Slash safety is decided per (path template, parameter) so single-segment
routes such as releases/tags/{tag} and editorconfig/{filepath} keep %2F.
Adds authorization_header, remote_password, mirror_password, mirror_token and
the AWS key fields to the redacted request fields. Deeply nested JSON from
Gitea is treated as text instead of raising RecursionError, and base64
uploads are capped before decoding.

tests/test_executor_units.py

@@ -5,7 +5,7 @@ from __future__ import annotations
 import pytest
 
 from aegis_gitea_mcp.gitea.encoding import (
-    SLASH_PATH_PARAMS,
+    SLASH_ROUTES,
     ArgumentError,
     check_segments,
     render_path,
@@ -20,8 +20,16 @@ from tests.test_executor_helpers import GET_BRANCH, GET_RAW_FILE, PULL_DIFF
 # Encoding
 
 
-def test_slash_parameter_set_is_documented_and_minimal() -> None:
-    assert {"filepath", "branch", "ref", "basehead", "head", "tag"} == SLASH_PATH_PARAMS
+def test_slash_routes_are_the_verified_wildcard_routes() -> None:
+    assert {name for _, name in SLASH_ROUTES} == {
+        "filepath",
+        "branch",
+        "ref",
+        "basehead",
+        "head",
+        "tag",
+    }
+    assert len(SLASH_ROUTES) == 11
 
 
 def test_render_path_returns_encoded_and_display_forms() -> None: