Redact URL query secrets in error text displayed by the web and TUI clients

[cliffhall]

Raised in review of #2488 (which closes #2423) and declined there as out of scope.

Background

#2423 asked the CLI/TUI to match the web client's URL redaction. The web client redacts query secrets (code, access_token, client_secret, …) through redactUrlQuery in exactly two places: the recorded Network log (core/mcp/fetchTracking.ts) and OAuthRequestTimeoutError's message (core/auth/requestTimeout.ts). #2488 extends the same guarantee to the CLI's stderr JSON envelope, which is written to terminals, CI logs and pipes.

The gap

Neither interactive client redacts error text it displays on screen.

• Web: clients/web/src/App.tsx puts err.message straight into toasts in several places (e.g. ~L138, ~L1304, ~L1417, ~L1634).
• TUI: about 20 sites across App.tsx, ResourcesTab, PromptsTab, SkillsTab, AuthTab and the *TestModals render err.message / String(err) as-is.

So a server or SDK error whose text contains https://…?code=… is shown verbatim. The risk is lower than the CLI case: this is the user's own screen, not a serialized or piped artifact. It is still a screenshot or screen-share away from leaking.

Suggested shape

• Move the CLI's redactUrlsInText (added in fix(cli): redact URL query secrets in the error envelope #2488, clients/cli/src/error-handler.ts) into core/mcp/fetchTracking.ts next to redactUrlQuery, with its tests under clients/web/src/test/core/.
• Have the CLI import it from core.
• Apply it at one display boundary per client rather than at each call site, e.g. a shared errorMessage(err) helper in each client (web already has utils/errorFormat).

[cliffhall]

Triage: Priority Low (total 5)

• Severity 2: server/SDK error text is shown on the user's own screen, not serialized or piped
• Urgency 2: wanted eventually
• Bonuses: +1 milestone