fix(sources): linear URL-cleaning patterns; keep the stripper off the startup path

PR #1932 CI:

- CodeQL (polynomial regular expression on uncontrolled data): the
  embedded-URL and keyed-pair patterns in stripUrlCredentials could retry
  from every position of a long run of letters. Matches now start only
  where a name can start (lookbehinds) and every name part is bounded, as
  is the bare-userinfo pattern; a spec times 50,000-character runs. The
  preceding "wip: linear URL-cleaning regexes" commit holds that change.
- Initial bytes ratchet (+135 B over after master's #1928 lowered the
  baseline): stripUrlCredentials sat behind the shared logging barrel,
  which startup code imports, so esbuild placed it in an initial chunk
  although only the lazy Sources page and switcher use it. It now lives
  beside its only consumer in playlist/shared/util source-display, and the
  logging barrel exports the two redaction helpers it needs. Measured
  locally on the merge with master: 1,537,497 bytes, within 1,538,700.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/architecture/iptvnator-ui-guidelines.md

@@ -1372,7 +1372,8 @@ in `@iptvnator/playlist/shared/util` (`source-display`, `source-format`,
 - **No credentials on screen.** Names come from `sourceDisplayName`: a URL, a
   URL-derived name such as `get.php?username=…&password=…` or any name holding
   the source's password, MAC or URL secrets becomes the host. URLs come from
-  `sourceDisplayUrl`, built on `stripUrlCredentials` (shared logging): no
+  `sourceDisplayUrl`, built on `stripUrlCredentials` (beside it in
+  `source-display`, out of the eager logging barrel): no
   userinfo, sensitive query or fragment parameters, or Xtream path
   credentials; Xtream shows `scheme://host:port · username`. Copy URL copies
   the full address on request.

libs/playlist/shared/util/src/lib/source-display/source-display.ts

@@ -1,10 +1,11 @@
-import { isSensitiveKey, stripUrlCredentials } from '@iptvnator/shared/logging';
+import { isSensitiveKey } from '@iptvnator/shared/logging';
 import {
     PlaylistMeta,
     playlistDisplayLabel,
     playlistNameHasCredentials,
     resolvePlaylistSourceKind,
 } from '@iptvnator/shared/interfaces';
+import { stripUrlCredentials } from './strip-url-credentials';
 
 export type SourceDisplayFields = Partial<
     Pick<

libs/playlist/shared/util/src/lib/source-display/strip-url-credentials.ts

@@ -2,7 +2,7 @@ import {
     isSensitiveKey,
     looksLikeSearchParams,
     XTREAM_CREDENTIAL_PATH_SEGMENTS,
-} from './redact-sensitive-data';
+} from '@iptvnator/shared/logging';
 
 /**
  * Short account keys some playlist URLs use. A log line keeps them for
@@ -131,7 +131,10 @@ function stripUrl(value: string, depth: number): string | null {
 }
 
 /**
- * A URL safe to show on screen. Where the log redactor replaces secrets with
+ * A URL safe to show on screen. It lives beside its only consumer
+ * (`source-display`): behind the shared logging barrel, which startup code
+ * imports, it rode into the initial bundle.
+ * Where the log redactor replaces secrets with
  * a marker, this drops them: the userinfo, every query or fragment parameter
  * the redactor treats as sensitive (`username`, `password`, `token`, `mac`,
  * …), and the two account segments after `/live/`, `/movie/`, `/series/` or

libs/shared/logging/src/index.ts

@@ -1,7 +1,9 @@
 export {
     isSensitiveKey,
+    looksLikeSearchParams,
     REDACTED_VALUE,
     redactSensitiveData,
+    XTREAM_CREDENTIAL_PATH_SEGMENTS,
 } from './lib/redact-sensitive-data';
 export type { RedactionOptions } from './lib/redact-sensitive-data';
 export {
@@ -25,4 +27,3 @@ export type {
     RendererPerformancePhaseMetadata,
     RendererPerformancePhaseOutcome,
 } from './lib/renderer-performance-phase';
-export { stripUrlCredentials } from './lib/strip-url-credentials';