fix: redact the zone password from browser connection errors

[karaposu]

Problem

The scraping-browser CDP endpoint embeds the zone password in the URL userinfo (wss://brd-customer-…-zone-…:PASSWORD@brd.superproxy.io:9222 — the format the proxy protocol requires). When a connection attempt fails, Playwright quotes that endpoint verbatim, password included, in the error — in message, in stack, and in an enumerable log array of ws call-log lines (verified against a live connectOverCDP failure; the password appears four times).

browser_session.js both logged that raw error object and re-threw it. And because every browser tool calls get_page() outside its try, the raw error is not wrapped in UserError — it propagates to fastmcp, which puts error.message into the client-visible failure text. So a routine connection drop (the reconnect path exists because they're routine) can print the zone password in plaintext to:

1. the server's stderr log — which MCP clients capture to disk and users paste into public bug reports;
2. the MCP client, inside the tool-error text.

Same defect class as the scrape_batch bearer-token leak addressed in #163 — this is its browser-path twin.

Fix

• redact_credentials() — a format-based scrubber (wss://user:PASSWORD@ → wss://user:***@) that keeps host and customer/zone id for debugging;
• Browser_session._sanitize() — applies the regex and removes the session's exact password (parsed structurally from its own endpoint), so a password containing / or @ can't leave a fragment;
• every error log site in the module goes through _sanitize;
• the connection path throws a fresh Error(sanitized message) instead of re-throwing the Playwright object — a new Error carries no log array and a clean stack, so no carrier survives to any downstream sink.

Behaviour note

The client-visible connection-failure text now shows :***@ in place of the password; the diagnostic core (connect ECONNREFUSED …, zone/customer id) is preserved. Nothing in the codebase matches on the raw Playwright message or error type.

Tests

test/redact-credentials.test.js: the scrubber against the real captured Playwright error text; idempotency/no-op cases; an exotic-charset password (pa/ss@word); and an integration test driving a real connectOverCDP failure through get_browser, asserting the propagated error contains no trace of the password in message, stack, or any enumerable property.

Notes

Independent of #163 (no shared commits); only touches browser_session.js + tests.