feat(config): wrap credentials in SecretStr (audit S-4)

database_url, migration_database_url, mcp_auth_token and the mathpix app
id/key are now pydantic SecretStr, so they render as '**********' in any
repr/log/traceback instead of leaking the plaintext credential. Consumers
(db.get_conn, cli.migrate, mcp._require_http_token, mathpix.extract_formulas)
call .get_secret_value() at the point of use. Tests updated to the SecretStr
type.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

codex/cli.py

@@ -45,7 +45,7 @@ def migrate() -> None:
     from codex.db import apply_schema
 
     settings = get_settings()
-    url = settings.migration_database_url or settings.database_url
+    url = (settings.migration_database_url or settings.database_url).get_secret_value()
     try:
         with psycopg.connect(url, row_factory=psycopg.rows.dict_row) as conn:
             apply_schema(conn)