fix: mask api keys when visible chars is zero
Co-authored-by: hu-qi<huqi1024@gmail.com>
# message auto-generated for no-merge-commit merge:
!1032 merge fix-mask-api-key-visible-chars into develop
fix: mask api keys when visible chars is zero
Created-by: huqi
Commit-by: hu-qi
Merged-by: ZYQ5333
Description: ## Summary
- Fully mask API keys when visible_chars <= 0 to avoid leaking the full key via api_key[-0:]
- Add regression coverage for visible_chars=0, negative values, and the default trailing-character behavior
## Duplicate check
- Checked issue #822 comments: no human claim/comment found
- Checked open/closed/merged MR pages for #822, mask_api_key, visible_chars, security_utils, api_key, leak/泄露/脱敏 before coding; no direct duplicate found
- Rechecked before push; GitCode API/listing was intermittently timing out, but no direct match surfaced from the available checks
## Tests
- uv run --project backend pytest backend/tests/test_security_utils.py -q
- uv run --project backend pytest backend/tests/test_security_utils.py backend/tests/test_deepsearch_logger_security.py -q (blocked during collection because local Settings requires DB_HOST)
Fixes [#822](https://gitcode.com/openJiuwen/agent-studio/issues/822)
See merge request: openJiuwen/agent-studio!1032
