feat: 完成T-503敏感信息提示与脱敏

- 保存或变更账号密码、AI API Key 前弹出本地明文保存提示

- 新增敏感值打码、结构化日志脱敏和自由文本替换工具

- 补充 GUI/appconfig 单测，覆盖明文提示和脱敏边界

- 同步任务看板、当前状态、架构、API、路由和编码规则文档

tests/test_appconfig.py

@@ -113,6 +113,30 @@ class AppConfigTests(TempDirMixin, unittest.TestCase):
 
         self.assert_removed(temp_dir)
 
+    def test_sanitize_for_log_masks_secret_fields(self):
+        payload = {
+            "name": "demo",
+            "api_key": "sk-1234567890",
+            "nested": {
+                "password": "account-secret",
+                "items": [
+                    {"provider_token": "token-secret"},
+                    {"value": "safe"},
+                    {"api_key": {"value": "nested-secret"}},
+                ],
+            },
+        }
+
+        sanitized = appconfig.sanitize_for_log(payload)
+
+        self.assertEqual("demo", sanitized["name"])
+        self.assertEqual("sk-1***7890", sanitized["api_key"])
+        self.assertEqual("acco***cret", sanitized["nested"]["password"])
+        self.assertEqual("toke***cret", sanitized["nested"]["items"][0]["provider_token"])
+        self.assertEqual("safe", sanitized["nested"]["items"][1]["value"])
+        self.assertEqual("***", sanitized["nested"]["items"][2]["api_key"])
+        self.assertEqual("sk-1234567890", payload["api_key"])
+
 
 if __name__ == "__main__":
     unittest.main()