refactor(security): consolidate the two one-off secret-redaction helpers into one shared autobot_shared util #12242

Consolidation opportunity — one shared secret-redaction util (surfaced during #11302)

The SLM backend now has two independent, one-off secret-redaction implementations with different coverage, and there is no shared redactor in autobot_shared:

• autobot-slm-backend/api/monitoring.py:864 _redact_app_log_line(line) — regex-based, masks Authorization/Bearer headers + token=/secret=/password=/api_key= KV pairs in raw log-line text. Added in SLM GUI has no application-log visibility — /api/monitoring/logs only serves fleet node events, not backend/frontend error logs #11302 (app-log viewer) precisely because no reusable redactor existed.
• autobot-slm-backend/api/code_sync.py:4013 _mask_secret_extra_vars(extra_vars) — masks dict values whose key matches _SECRET_EXTRA_VAR_PREFIXES.

Why consolidate

• Drift/coverage risk (security): a redactor is a security control. Two copies with different pattern sets means a secret redacted in one path can leak in the other; hardening must be applied in N places.
• Reuse: both backends emit logs/telemetry that should be redacted consistently; a shared util (line-level + kv/dict-level) belongs in autobot_shared (e.g. autobot_shared/security/redaction.py) alongside the existing secret-file helpers.

Proposed

• Add autobot_shared/security/redaction.py with redact_text(str) -> str (line/text) and redact_mapping(dict) -> dict (kv), sharing ONE canonical secret-key/pattern set.
• Replace _redact_app_log_line and _mask_secret_extra_vars with calls into it (behaviour-preserving; add tests for both shapes).
• Audit other ad-hoc masking (sed 's/password/***/' etc.) to adopt it.

Discovered during #11302 (SLM application-log viewer). No behaviour change intended — DRY + consistent coverage of a security control.