feat: add config toggle to disable secret redaction

New config option:

  security:
    redact_secrets: false  # default: true

When set to false, API keys, tokens, and passwords are shown in
full in read_file, search_files, and terminal output. Useful for
debugging auth issues where you need to verify the actual key value.

Bridged to both CLI and gateway via HERMES_REDACT_SECRETS env var.
The check is in redact_sensitive_text() itself, so all call sites
(terminal, file tools, log formatter) respect it.

hermes_cli/config.py

@@ -104,6 +104,10 @@ DEFAULT_CONFIG = {
         },
     },
     
+    "security": {
+        "redact_secrets": True,  # Mask API keys, tokens, passwords in tool output
+    },
+
     "display": {
         "compact": False,
         "personality": "kawaii",