Avoid leaking credentials when logging resolved configs to W&B (or MLflow)

Model management serializes the complete resolved trainer configuration and uploads it to W&B (or MLflow on my branch). This may expose secrets supplied through configuration, such as:

- API keys and access tokens
- Passwords or client secrets
- Credential-bearing tracking URIs, e.g. https://user:password@host
- Service-account credentials

Potential fixes

- Recursively redact known secret-like keys before upload.
- Remove URL user-info from configuration values.
- Preserve unresolved ${ENV_VAR} references where possible.
- Add an option to disable configuration uploads.
- Alternatively, log an explicit allowlist of reproducibility-safe fields.
- Redaction should avoid false positives for model settings such as use_cls_token or num_memory_tokens.

Questions

- Are configurations expected to contain resolved credentials at this point?
- Should W&B and MLflow use the same sanitization policy?
- Would an allowlist be preferable to heuristic redaction?
- Should local saved configs remain complete while only remote uploads are sanitized?