fix(web): redact extracted content before truncate-store

[hashbender]

Summary

This redacts secrets from web_extract provider content before the new truncate-and-store path returns it to the model or writes the full page copy to cache/web.

Why

After NousResearch#54843, web_extract returns clean provider content directly instead of sending every page through an auxiliary LLM summarizer. That fast path still blocks secrets embedded in the URL, but it did not redact secrets present in the extracted page body.

As a result, if a backend returns page text containing values like OPENAI_API_KEY=sk-..., the raw secret can be included in the tool result sent to the model. For large pages, the same raw content can also be written into the stored full-text cache file used for paging.

Changes

• Apply redact_sensitive_text(..., force=True) after base64 image cleanup and before truncate/store processing.
• This redacts both the inline model-visible content and the stored cache/web full-text copy.
• Add regression coverage proving raw provider-returned secrets do not appear in either the web_extract response or the stored full-text file.

Tests

python -m pytest tests/tools/test_web_tools_truncate.py -q --timeout-method=thread
13 passed

python -m pytest tests/tools/test_browser_secret_exfil.py -q --timeout-method=thread
12 passed

---
Mirror-of: NousResearch/hermes-agent#55935
https://github.com/NousResearch/hermes-agent/pull/55935