test: security suite for auth, startup, redaction; fix: mask secrets in object keys

src/aegis_gitea_mcp/security.py

@@ -90,7 +90,11 @@ def sanitize_data(value: Any, mode: str = "mask") -> Any:
         Sanitized payload value.
     """
     if isinstance(value, dict):
-        return {str(key): sanitize_data(item, mode=mode) for key, item in value.items()}
+        # Keys are data too: a secret can sit in an object key (``{"<token>": 1}``).
+        return {
+            sanitize_data(str(key), mode=mode): sanitize_data(item, mode=mode)
+            for key, item in value.items()
+        }
 
     if isinstance(value, list):
         return [sanitize_data(item, mode=mode) for item in value]