fix: redact identity secrets through a public hook and mask issued agm_ tokens

Identity gains a redact field that the executor honours, so the OAuth
resolver no longer needs an executor subclass overriding private
internals. Opaque agm_ tokens issued by our authorization server are now
masked by the secret patterns wherever they appear in content.

tests/test_oauth_startup.py

@@ -10,10 +10,10 @@ import pytest
 from pytest_httpx import HTTPXMock
 
 from aegis_gitea_mcp import transports
+from aegis_gitea_mcp.gitea import GiteaExecutor
 from aegis_gitea_mcp.oauth import OAuthSetupError
 from aegis_gitea_mcp.oauth import components as components_module
 from aegis_gitea_mcp.oauth.components import RATE_LIMITED_PATHS, build_oauth_components
-from aegis_gitea_mcp.oauth.resolver import OAuthGiteaExecutor
 from aegis_gitea_mcp.oauth.store import STORE_FILENAME
 from aegis_gitea_mcp.transports import AccessLogQueryFilter, http_startup_errors, run_http
 from tests.test_oauth_helpers import (
@@ -129,7 +129,7 @@ def test_components_wiring() -> None:
     settings = oauth_settings()
     extras = build_oauth_components(settings)
 
-    assert isinstance(extras.executor, OAuthGiteaExecutor)
+    assert isinstance(extras.executor, GiteaExecutor)
     assert extras.rate_limited_paths == RATE_LIMITED_PATHS
     paths = {route.path for route in extras.extra_routes}  # type: ignore[attr-defined]
     assert paths == {"/oauth/consent", "/oauth/callback", "/.well-known/oauth-protected-resource"}