security: broaden headersCommand failure-message masking beyond pattern-based maskString

Found during v0.9.1 release review (CTO). `Telemetry.maskString()` only redacts known shapes (sk-…, Bearer , emails, hosts). A verbose auth CLI in `headersCommand` that prints a bare unprefixed token to stderr on failure would surface unmasked in `status.error`/`mcp list`/logs. Consider entropy-based redaction for the headersCommand failure path, or document the residual risk.