fix: improve app store install flow diagnostics

[bugkeep]

Problem

When App Store installs failed, the product often surfaced low-context messages such as resource-not-ready or generic wait errors. That made it hard to tell whether the failure came from chart defaults, missing cluster capabilities, or a real Helm/runtime error.

This PR previously also included recommended install value changes. Those product-behavior defaults have been removed from this PR so the change stays focused on diagnostics.

Root Cause

The install path did not provide enough normalized diagnostics back to the UI and could leak sensitive repository credentials in some error messages. The stream client also needed focused coverage for terminal install states such as ABORTED and DONE.

Fix

• improve Helm install diagnostics so wait failures are easier to interpret
• redact repository credentials from Helm/chart loading errors, including URL userinfo and common credential query parameters
• add fallback redaction for malformed URLs that cannot be parsed normally
• keep App Store install values unchanged in this PR
• add frontend coverage for Helm install stream terminal states

Validation

• go test ./store
• attempted frontend test with yarn test --runTestsByPath src/backend/HelmBackend.test.js --watchAll=false, but this repo has no test script in web/package.json
• Alibaba Open Code Review was run after the change
• verified this PR still contains exactly one commit on top of master

OCR Notes

OCR initially flagged that this PR mixed diagnostics with recommended values behavior. The recommended values files and js-yaml dependency were removed from this PR.

OCR also flagged credential redaction edge cases. This PR now covers userinfo redaction, common sensitive query keys, token-only userinfo fallback, malformed query fallback, and host:port false-positive avoidance.

OCR still recommends Go unit tests for the redaction helpers. The local repository publishing rule currently says not to upload *_test.go files, so no Go test file is included here.

Scope

This PR improves install diagnostics, error redaction, and stream-state coverage. It does not change chart default values, service exposure defaults, storage, DNS, ingress, or platform bootstrap behavior.