Stop logging OAuth secrets

[zerox80]

What changed

• Removed OAuth code, token and state values from auth logs.
• Redacted sensitive request and response fields in HTTP debug logs.
• Made token response toString output safe, so accidental logs do not dump tokens.

Why

Some debug/support logs could include OAuth credentials. This keeps the useful flow logs, but drops the secret values.

Checks

• git diff --check
• Targeted rg scans for the old token/code log messages
• Gradle tests not run locally because JAVA_HOME is not set and java is not on PATH