fix(console): redact secret-bearing commands from the console echo and history (W7-1)

The RPC console echoed and stored typed commands verbatim, so `walletpassphrase
<secret>`, `z_importkey <key>`, `encryptwallet <pass>` etc. left the secret in the
visible log AND the 100-entry recall history (copyable). Adds a pure, unit-testable
RedactConsoleCommand()/ConsoleCommandCarriesSecret() (allowlist of 13 secret-bearing
first-tokens) in console_tab_helpers; submitConsoleCommand() now echoes and stores
`> walletpassphrase ****` while still executing the real command unredacted. Bare
secret commands and non-secret commands pass through unchanged.

Output-secret commands (dumpprivkey / z_exportkey / z_exportmnemonic) — whose secret is
in the RESULT — are a separate redaction concern, tracked as a follow-up.

First fix in the wallet-hardening P0-A cluster (see docs/wallet-hardening.md). New
testConsoleSecretRedaction (11 assertions); ctest 1/1.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/ui/windows/console_tab_helpers.h

@@ -1,5 +1,7 @@
 #pragma once
 
+#include <string>
+
 namespace dragonx {
 namespace ui {
 
@@ -14,5 +16,14 @@ float ComputeConsoleOutputHeight(float availableHeight,
                                  float minHeightRatio);
 float ClampConsoleWrapWidth(float contentWidth, float paddingX);
 
+// True if `cmd`'s first token names a console/RPC command that carries a SECRET on its command line
+// (passphrase, private/spending/viewing key, mnemonic). Output-secret commands (dumpprivkey,
+// z_exportkey, z_exportmnemonic) are NOT covered — their secret is in the result, a separate concern.
+bool ConsoleCommandCarriesSecret(const std::string& cmd);
+
+// A display/history-safe copy of `cmd`: the command name with its arguments replaced by "****" when
+// it carries a secret, else `cmd` unchanged. The real command is still executed unredacted.
+std::string RedactConsoleCommand(const std::string& cmd);
+
 } // namespace ui
 } // namespace dragonx