Dato Agent: "Copy diagnostics" exports provider API keys and OAuth tokens in plain text #159

Summary

Copy diagnostics (shown on failed turns) puts live credentials on the clipboard:

• configuration.anthropicApiKey / openAiApiKey / activeApiKey: the provider API key
• oauthCredentials.token.accessToken: the DatoCMS MCP OAuth token

Editors naturally paste diagnostics into GitHub issues, support chats and Slack, so these secrets leak. The current tests (serializeDiagnostics "preserving raw diagnostic values" and the AgentFrame diagnostics test) explicitly assert that the raw values are kept.

Proposed fix

Redact credential-like fields during serialization, and keep everything else (prompt, events, transcript, system prompt) for debugging:

• Field names ending in apiKey, accessToken, refreshToken, secret or password, plus token, idToken, codeVerifier, authorization and cookie, become [Redacted] when they hold a non-empty string. Empty values are kept, so "no key configured" is still visible.
• sk-… keys and Bearer … tokens embedded in any string (error messages, URLs) are scrubbed.

PR to follow.