Harden SENSITIVE_KEY_PATTERN log redaction for snake_case secret keys #140

src/index.ts redactSecrets uses SENSITIVE_KEY_PATTERN to redact secrets before logging the plugin options blob. It matches the camelCase config keys in use today (clientSecret, signingKeyPem, initialAccessToken) but not snake_case variants (private_key, initial_access_token, signing_key_pem).

Defense-in-depth: broaden the regex to also catch snake_case, e.g. /secret|signing_?key_?pem|initial_?access_?token|private_?key|password/i. Over-redaction in a log is safe, so the downside is nil.

Low priority / hardening. Surfaced by the gemini-review bot on #134 (src/index.ts:20).