fix(#261): redact token from websocket connection log in debug mode (#330)

Redacts the token query parameter from the URL before logging it to logcat in debug mode. This prevents sensitive token leakage on rooted devices or via adb logcat as requested in SEC-08.

app/src/main/java/com/m57/hermescontrol/data/ws/HermesWsClient.kt

@@ -170,7 +170,8 @@ object HermesWsClient {
         val url = AuthManager.wsUrl()
         // B2 (Jun 18 2026, kanban t_8884db16): url contains the auth token
         // as a query param — never stream to logcat in release builds.
-        if (BuildConfig.DEBUG) Log.d(TAG, "Connecting to $url")
+        val safeUrl = url.replace(Regex("token=[^&]+"), "token=REDACTED")
+        if (BuildConfig.DEBUG) Log.d(TAG, "Connecting to $safeUrl")
 
         val request = Request.Builder().url(url).build()
         webSocket = okHttpClient.newWebSocket(request, WsListenerImpl())