Redact API keys from error technical-details disclosure

SABnzbd and Tautulli embed their API key in the request URL, so it
was showing up verbatim in the raw exception text under "Technical
details" on the dashboard — visible to anyone with the study-room
password. Added a redact_secrets filter that strips apikey/token/
password query params before the raw string is rendered.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

app.py

@@ -66,7 +66,21 @@ def friendly_error(raw, service=""):
     return f"{name} couldn't be reached."
 
 
+_SECRET_PARAM_RE = re.compile(
+    r"(?i)\b(apikey|api_key|token|password)=([^&\s'\")]+)"
+)
+
+
+def redact_secrets(raw):
+    """Strip API keys/tokens out of raw exception text before it's shown in
+    the UI. Some services (SABnzbd, Tautulli) embed the key in the request
+    URL, so it ends up verbatim in requests/urllib3 exception strings.
+    """
+    return _SECRET_PARAM_RE.sub(r"\1=[redacted]", str(raw or ""))
+
+
 app.jinja_env.filters["friendly_error"] = friendly_error
+app.jinja_env.filters["redact_secrets"] = redact_secrets
 app.config["SESSION_COOKIE_PATH"] = "/"
 app.config["SESSION_COOKIE_HTTPONLY"] = True
 app.config["SESSION_COOKIE_SAMESITE"] = "Lax"

templates/dashboard.html

@@ -980,7 +980,7 @@
     {% if raw %}
     <details class="error-detail">
       <summary>Technical details</summary>
-      <pre>{{ raw }}</pre>
+      <pre>{{ raw | redact_secrets }}</pre>
     </details>
     {% endif %}
   </div>