Secrets Discipline

Implement get_token(env: dict) reading env['API_TOKEN'] and returning it, raising KeyError('API_TOKEN') naturally when missing. Then redact(s) returning s with any substring 'secret=XYZ' replaced by 'secret=[REDACTED]' (regex sub). Prove your logger never prints raw secrets by returning the redacted form for logging.