fix(node-lib): keep rpc credentials and staking keys out of logs and help output

[erubboli]

Problem

At startup the node logged its entire parsed command line at INFO level, including rpc_username, rpc_password and --chain-genesis-staking-settings (which carries staking and VRF private keys). The log file was created with default umask permissions (typically 0644) and its level was not configurable, so the secrets landed world-readable on disk on every start. Separately, clap's [env: NAME=value] help rendering displayed environment-sourced values for these options, and the API server daemons logged the postgres connection string including the password at debug level.

Change

• Stop logging the full options dump; log a curated, secret-free summary instead.
• Type-level redaction: new Redacted<T> wrapper (zeroizing Debug) for RPC credential fields; redacted Debug for GenesisStakingSettings (pool id stays visible, private keys do not).
• Log files (current and rotated, including files written by earlier versions) are restricted to 0600, with failures reported after logging is initialized; the scan anchors file identity in the directory entry so a path swapped mid-scan is detected.
• Secret-bearing CLI options hide their environment values in help output (hide_env_values) across node-lib, wallet-cli, wallet-rpc and the API server daemons; guard tests pin every option as classified secret/non-secret, and the classification helper recurses into subcommands.
• The postgres connection log redacts the password; clap parse errors never echo argument values (value-free diagnostics only).

Testing

• New unit tests: redacted debug rendering for credentials and staking settings, log-name matching, permission-fix error collection, env-value hiding guard tests (including subcommand coverage), value-free clap error rendering canaries, postgres log redaction.
• cargo test green for affected crates; workspace fmt/clippy checks pass.

[nullPointerEnjoyer]

Closing in favor of the same-repo PR #2146 (identical branch content; keeps the CI review workflow active).