fix: redact identity secrets through a public hook and mask issued agm_ tokens

Identity gains a redact field that the executor honours, so the OAuth
resolver no longer needs an executor subclass overriding private
internals. Opaque agm_ tokens issued by our authorization server are now
masked by the secret patterns wherever they appear in content.

src/aegis_gitea_mcp/oauth/components.py

@@ -15,10 +15,11 @@ from starlette.routing import Route
 from aegis_gitea_mcp.audit import AuditLogger
 from aegis_gitea_mcp.auth import MCP_SCOPE, AdminIdentityResolver
 from aegis_gitea_mcp.config import Settings
+from aegis_gitea_mcp.gitea import GiteaExecutor
 from aegis_gitea_mcp.oauth import OAuthSetupError
 from aegis_gitea_mcp.oauth.callback import build_browser_routes
 from aegis_gitea_mcp.oauth.provider import CONSENT_PATH, GiteaOAuthProvider, OAuthTokenVerifier
-from aegis_gitea_mcp.oauth.resolver import OAuthGiteaExecutor, OAuthIdentityResolver
+from aegis_gitea_mcp.oauth.resolver import OAuthIdentityResolver
 from aegis_gitea_mcp.oauth.store import OAuthStore, OAuthStoreError
 from aegis_gitea_mcp.oauth.upstream import CALLBACK_PATH, GiteaUpstream
 from aegis_gitea_mcp.transports import HttpAuthExtras
@@ -88,7 +89,7 @@ def build_oauth_components(
 
     upstream = GiteaUpstream(settings, client_factory=client_factory, clock=clock)
     provider = GiteaOAuthProvider(settings, store, upstream, clock=clock, audit=audit)
-    executor = OAuthGiteaExecutor(
+    executor = GiteaExecutor(
         settings, client=executor_client, extra_secrets=[key.get_secret_value()]
     )
     admin = AdminIdentityResolver(settings, executor) if settings.gitea_token is not None else None