fix: protect build arguments across API and native SDK - #864

Service and deployment reads exposed current and historical build-argument secrets. This change masks non-empty values at the shared platform boundary and recovers echoed masks on writes, preserving working builds and rollback snapshots. Fixes #854 when the integration branch reaches main.

• Covers service CRUD, Compose sync and drift, source scans, deployment history and build status through both HTTP and the native SDK.
• Preserves empty strings, inherited null arguments and whole-map replacement. Masked arguments retain their stored interpolation provenance; new literal values cannot inherit a stale template marker.
• Adds project/service/key-scoped HMAC fingerprints for comparing stored literal values without disclosing them. Inherited or interpolated arguments are excluded; fingerprints do not attest running-container values.
• Keeps explicitly authorized includeEnv: true source editing scans functional. Internal merge baselines stay private, and retained snapshots remain usable for rollback.

Abdullah Mohamed's original commit is retained. The PR is updated for the current shared platform architecture and targets feat/bugfix-integration-2026-09-15, ahead of the draft integration PR #891.

Validation with repository-pinned Bun 1.3.10:

• 292 targeted API tests passed, including six tests using real PGlite, PAT authentication, service writes and native/HTTP deployment reads.
• 29 SDK tests passed, including real native-worker source preparation and staged-upload scans.
• API typecheck and documentation checks passed (including SDK examples).
• Historical-disclosure and masked-sync regressions both fail on the pre-fix branch and pass with this change.

The separate encryption-at-rest and environment-precedence concerns in #844 remain under review.