fix(opencode): redact secrets from config responses

[rekram1-node]

Summary

• add a public config projection while keeping resolved config available internally
• apply it to both GET /config and GET /global/config
• replace sensitive provider option values recursively, including provider headers and model-level options/headers, with [redacted]
• replace every MCP environment and header value, plus MCP OAuth clientSecret, with [redacted]
• preserve harmless provider and model metadata/options and MCP commands, URLs, enablement, OAuth client IDs, scopes, and callback settings

Tests

• bun test test/server/httpapi-config.test.ts --timeout 30000 (3 passed)
• bun typecheck from packages/opencode

Canary secrets are resolved through {file:...} substitutions before the endpoint response is asserted. Public schemas are unchanged, so the SDK was not regenerated.

Related issues

• Closes Web/serve config endpoint exposes resolved provider and MCP secrets to authenticated clients #22157
• Related to [FEATURE]: Full MCP client capabilities #28567