fix: redact credentials in database connection URLs

[varshith84]

Closes #6.

Redact the username/password portion of PostgreSQL, Redis, and MySQL URLs in both mask and hash modes, retaining their scheme, host, port, and database path. Passwordless URLs remain intact, including user@host forms that would otherwise match the email rule. Update both README languages and regenerate the tracked bundle.

Validation:

• npm run doctor: all checks passed
• npm test: 219 passed
• npm run typecheck, npm run bundle, and git diff --check: passed
• New fixtures cover each scheme, empty usernames, encoded credentials, IPv6 hosts, punctuation, multiple occurrences, and passwordless URLs. The credential fixtures failed before the rule was added.

This is pattern-based best-effort redaction, consistent with the existing API. Prepared with Codex assistance.

[kittimzhe]

Merged — thank you! Verified locally before merging: typecheck clean, 219/219 tests green, and the rebuilt bundle reproduces the committed lib/ byte-for-byte.

Two details worth calling out for future contributors reading this thread: the URL-encoded-password and IPv6/multi-colon-password test cases, and the lookbehind on the email rule so a passwordless postgres://user@host/db no longer gets its user/host pair eaten as an email. Both were exactly the sharp edges this issue was filed about.