Sanitize account check IPC statuses

Centralize DebridAccountStatus sanitizing for direct account-check responses. The shared sanitizer collects stored and submitted credential variants, including raw, trimmed, URL-encoded, URL-decoded, full credential lines, and login:secret forms, then redacts credential-like query params, key-value echoes, authorization, cookie, API-key, token, password, secret, session, backup passphrase, and archive password text before any status DTO reaches the renderer.

Apply the sanitizer to bulk checkDebridAccounts results, single checkAccountCredentials results, and account command credential checks before returning, throwing, or persisting statuses. Reuse the same sanitizer for renderer snapshots so status redaction stays on one path.

Replace the Debrid-Link key popup copy action with a truthful non-secret masked-identity copy action and cover the regression so no renderer path copies key.token or reports a secret-copy success without a secret readback.

tests/app-shell.test.tsx

@@ -13,6 +13,9 @@ describe("desktop shell", () => {
 
     expect(source).not.toMatch(/<span[^>]*className="[^"]*link-popup-click/);
     expect(source.match(/<button[^>]*className="[^"]*link-popup-click[^>]*type="button"/g)).toHaveLength(3);
+    expect(source).not.toContain("navigator.clipboard.writeText(key.token)");
+    expect(source).toContain("navigator.clipboard.writeText(key.masked)");
+    expect(source).toContain("Maskierte Kennung kopiert");
   });
 
   it("confirms before removing a collector tab", () => {