hardening(cli): --help still prints [env: CORA_BASE_URL=...]; redact credentials in URL-valued env defaults #687

Problem

0.19.0 hides the env value of --api-key and --token in --help (a good fix). --base-url is bound to CORA_BASE_URL and still prints its value:

--base-url <BASE_URL>
    API base URL
    [env: CORA_BASE_URL=https://gateway.example.internal/v1]

Most base URLs are harmless. But some gateways carry credentials in the URL (userinfo https://user:pass@host/v1, or a key in the query string ?key=...), and --help output ends up in logs, CI output and screenshots, the same exposure that was just fixed for the API key. It also leaks internal gateway hostnames, and [env: CORA_MODEL=...] shows model/deployment names.

Note: no credential exposure was observed in our case; this is a hardening request for the same class of issue.

Proposal

• Print env defaults for URL-valued options with the userinfo and query string stripped (https://host/v1), or hide the value as for --api-key.
• Consider a global hide_env_values for all options bound to CORA_* env vars when CI is set.

Done when

CORA_BASE_URL=https://u:p@host/v1?key=k cora review --help does not contain p or k=k; a test asserts it.