fix(backup): redact S3 credentials from logs and error output

[rafaumeu]

Problem

Closes #4621

S3 backup credentials (access key ID + secret access key) are logged in plaintext to Dokploy's structured logger output (service stdout) on every backup run, not just on errors. Any operator who can read service logs — including log aggregators, syslog forwarders, or anyone with docker service logs dokploy access — can recover S3 credentials.

Two leak points identified:

1. getBackupCommand() in utils.ts — logs the full rcloneCommand (including --s3-access-key-id and --s3-secret-access-key flags) via logger.info on every run
2. keepLatestNBackups() in index.ts — surfaces the rclone command (with credentials) via console.error(error) on failure

Solution

Extracted redactRcloneCredentials() — a pure function that masks --s3-access-key-id="..." and --s3-secret-access-key="..." values with [REDACTED] using regex.

Applied to both leak points:

• logger.info in getBackupCommand() — rcloneCommand is now redacted before logging
• console.error in keepLatestNBackups() — error string is now redacted before output

The function is in its own file (redact.ts) with zero dependencies for clean testability.

Testing

6 unit tests in __test__/backups/redact-credentials.test.ts:

• Redacts access key from rclone command
• Redacts secret access key from rclone command
• Redacts both credentials simultaneously
• Does not modify non-credential flags (region, endpoint, etc.)
• Handles commands with no credentials (no-op)
• Handles error strings containing credentials

All tests pass, Biome lint clean.