fix: preserve empty API keys in redaction output

[Copilot]

RedactSecret returned "****" for empty strings, causing config show (which marshals RedactedCopy) to render unset API keys as non-empty placeholders — making it impossible to distinguish an unconfigured key from a masked one, and risking users persisting "****" as a real key value.

Changes

• internal/config/redact.go: RedactSecret returns "" immediately for empty input; non-empty short strings still produce "****"
• internal/config/config_test.go, cmd/cmd_test.go: updated empty-string test cases to expect "" instead of "****"

// Before
RedactSecret("")  // => "****"

// After
RedactSecret("")  // => ""
RedactSecret("short")  // => "****"  (unchanged)
RedactSecret("sk-longapikey1234")  // => "sk-l...1234"  (unchanged)

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

[Copilot]

Pull request overview

This PR fixes redaction behavior so empty API key values remain empty in display/redacted outputs, allowing users to distinguish “unset” from “set but masked” when viewing configuration.

Changes:

• Update RedactSecret to return "" for empty input while preserving existing masking behavior for non-empty secrets.
• Adjust config-related tests to expect "" (not "****") for empty secret values.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
internal/config/redact.go	Preserves empty-string secrets by returning "" early in RedactSecret.
internal/config/config_test.go	Updates TestRedactSecret to expect empty output for empty input.
cmd/cmd_test.go	Updates TestMaskKey to expect empty output for empty input.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.