fix(audit): redact quoted secret values

[jamiesun]

Fixes #19.

Summary

• redact quoted sensitive assignment values before unquoted fallback
• redact quoted sensitive flag values before unquoted fallback
• add table-driven coverage for quoted and unquoted assignment/flag forms

Verification

• go test ./internal/app -run 'TestRedactSensitiveTextCoversQuotedAndUnquotedValues|TestRun_BlockedCommandWritesRedactedAuditEvent'
• go test ./...
• git diff --check
• make check
• manual smoke: blocked command with password="alpha bravo" and --token "charlie delta" writes only values to audit JSONL