fix: redact blocked command JSON output

[jamiesun]

Summary

• redact secret-like arguments in --json command results using the existing audit redaction helper
• apply redaction to both the JSON command field and sshx-level error text
• add a regression test for blocked command JSON output with quoted secret-like values

Fixes #24

Verification

• go test ./internal/app -run 'TestRun_BlockedCommandJSONRedactsSecretLikeArguments|TestRun_BlockedCommandShortCircuits|TestEmitCommandJSONContracts|TestRedactSensitiveText' -count=1
• go test ./...
• git diff --check