a2acli: --debug raw wire logging with unconditional credential redaction

Part of #181 (Tier 2).

## Summary

`A2ACLI_OUT_007` (Tier 2) extends `--debug`: per §7.2, at Tier 2 developer diagnostics **include the raw protocol messages exchanged on the wire**.

`--debug` already exists from #176 — it installs a stderr `tracing_subscriber` and registers `a2a_client::middleware::LoggingInterceptor`. But that interceptor logs only the method name:

```rust
async fn before(&self, method: &str, _params: &mut ServiceParams) -> Result<(), A2AError> {
tracing::info!(method = method, "A2A client request");
Ok(())
}
```

No request body, no response body, no status or timing. So `--debug` today satisfies the Tier 1 reading of §7.2 ("request/response timing, retries, transport and version negotiation") only partially, and the Tier 2 reading not at all.

## Why

Wire-level logging is the difference between "the call failed" and "here is what we sent and what came back". It is also what the spec points callers at: `A2ACLI_INTERACT_002` requires a rejected identifier to *"surface the protocol error and point at `--debug`"* — which is only useful advice once `--debug` shows the exchange.

## The redaction requirement is load-bearing here

`A2ACLI_AUTH_004` (Tier 1) reads:

> Redacts credential material from diagnostic output, **including `--debug` raw-wire logging**; the redaction is not defeasible by a verbosity flag.

That row is satisfied today only because nothing is logged. Wire logging is exactly the thing it was written for, so this issue cannot land without redaction — and the redaction must not be escapable by any flag.

## Scope

- [ ] Log the raw request and response payload of every protocol call to stderr under `--debug`, on both the JSON-RPC and REST bindings.
- [ ] Redact credential material before it reaches the log: the `Authorization` header, `X-API-Key`, and any `--svc-param` whose name matches a declared security scheme. Redact by value, not by presence — the header should still be visible as `Authorization: (redacted)` so its attachment can be confirmed.
- [ ] Make redaction unconditional: no flag, env var, or verbosity level may disable it.
- [ ] Keep every byte of this on stderr; stdout stays the payload (§11.1).
- [ ] Tests: a `--debug` run shows the method, the request body and the response body; a `--debug` run with `--bearer`/`--api-key`/a credential `--svc-param` shows the header names but never the values, asserted against the secret string appearing nowhere in stderr.
- [ ] Whether `LoggingInterceptor` is extended in `a2a-client` or `a2acli` grows its own interceptor is an implementation choice — if the former, it is a public-API change to that crate and should be additive.

## Requirements closed

| ID | Requirement |
| --- | --- |
| `A2ACLI_OUT_007` | `--debug` enables diagnostic logging to stderr, including the raw protocol messages exchanged on the wire (§7.2) |

Also hardens `A2ACLI_AUTH_004` (Tier 1), which is currently satisfied only vacuously.