fix: redact identity secrets through a public hook and mask issued agm_ tokens

Identity gains a redact field that the executor honours, so the OAuth
resolver no longer needs an executor subclass overriding private
internals. Opaque agm_ tokens issued by our authorization server are now
masked by the secret patterns wherever they appear in content.

src/aegis_gitea_mcp/identity.py

@@ -23,11 +23,15 @@ class Identity:
         mode: ``admin-token`` or ``oauth``.
         token: Gitea token for this identity. Excluded from ``repr`` and never
             part of :meth:`metadata`.
+        redact: Further secrets of this identity (for example the OAuth user's
+            Gitea refresh token) that the executor replaces in every result.
+            Excluded from ``repr`` and comparisons.
     """
 
     login: str | None
     mode: IdentityMode
     token: str = field(repr=False)
+    redact: tuple[str, ...] = field(default=(), repr=False, compare=False)
 
     def metadata(self, sudo: str | None = None) -> dict[str, Any]:
         """Return result and audit metadata: ``{"login", "mode", "sudo"}``, never the token."""