fix(security): resolve Critical+High findings from module audit — agent, translate, superset_client

P0 — CRITICAL (CWE-798): JWT_SECRET crash-early
  Replace hardcoded super-secret-key fallback with os.environ["JWT_SECRET"]
  and ${JWT_SECRET:?} syntax in app.py + docker-compose files

P1 — HIGH: Frontend dependency CVEs
  Upgrade svelte 5.43.8 → 5.56.4 — resolves devalue DoS (GHSA-g2pg-6438-jwpf)
  and svelte XSS (GHSA-crpf-4hrx-3jrp, GHSA-m56q-vw4c-c2cp, GHSA-rcqx-6q8c-2c42)

P2 — MEDIUM: Logging hygiene + contract gaps + tool resolver refactor
  Apply _redact_sensitive_fields() in middleware + event streaming
  Truncate LLM error body to 100 chars
  Add @RATIONALE/@REJECTED to HandleResume + SaveConversation
  Refactor deterministic intent matching → LLM-driven tool resolution

P3 — LOW: Translate logging hardening
  Move _sanitize_url() to _utils.py (shared, no circular imports)
  Sanitize base_url before logging in _llm_call.py and _llm_async_http.py
  Emit EXPLORE warning when LLM_SSL_VERIFY=false disables TLS

superset_client module: passed clean — no changes needed

backend/src/agent/middleware.py

@@ -9,6 +9,7 @@
 from datetime import UTC, datetime
 
 from src.agent.context import get_user_jwt
+from src.agent.tools import _redact_sensitive_fields
 from src.core.logger import logger
 
 
@@ -42,7 +43,8 @@ async def log_tool_event(event: dict, conversation_id: str) -> None:
     if "data" in event:
         data = event["data"]
         if kind == "on_tool_start":
-            audit_payload["input"] = str(data.get("input", ""))[:500]
+            raw_input = data.get("input", "")
+            audit_payload["input"] = str(_redact_sensitive_fields(raw_input))[:500]
         elif kind == "on_tool_error":
             audit_payload["error"] = str(data.get("error", ""))[:500]