feat: add dynamic per-call SSH connections and secret redaction

- execute-command/upload/download accept host/port/username/password inline
  to open an ephemeral connection for a single call
- add redactSecret/redactSecrets to mask credentials in logs and errors
- logger log()/handleError() accept optional secrets[] for redaction
- add SSH_CONFIG_MISSING error code and --password-from-env CLI flag
- dynamic-mode startup: server runs with no static config

scripts/run-tests.js

@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+
+/**
+ * 测试运行器
+ * 使用 Node.js 内置的测试框架运行所有测试
+ */
+
+import { execSync } from 'child_process';
+
+console.log('🧪 运行测试...\n');
+
+try {
+  execSync('node scripts/build.js', {
+    stdio: 'inherit',
+    cwd: new URL('..', import.meta.url).pathname
+  });
+  execSync('node --test test/**/*.test.js', {
+    stdio: 'inherit',
+    cwd: new URL('..', import.meta.url).pathname
+  });
+} catch (err) {
+  process.exit(1);
+}