fix(system): S61-S62 — API cleanup, drone path routing, naming checker, .backup→.recovery rename (#142)

- API: 18-item P0/P1/P2 cleanup (debug prints→logger, help gate fix, URL injection fix, key masking, unused imports)
- Drone: passport walk-up replaces hardcoded src/aipass/<branch> pattern, 13 naming bypasses removed
- Seedgo: naming checker fixed (__dunder__ skip + column-0 scope detection) — eliminates 71 false positives system-wide
- Spawn: .backup→.recovery rename (pre-change snapshots no longer conflict with backup branch namespace)
- .gitignore: .recovery/ added
- HERALD.md: Updated through S62 (backup audit, .recovery rename, night shift launch)
- README.md: Stats updated (141 PRs, 2900+ tests)

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/aipass/api/apps/modules/api_key.py

@@ -20,10 +20,9 @@ from pathlib import Path
 
 from typing import List
 from aipass.prax.apps.modules.logger import system_logger as logger
-from aipass.cli.apps.modules import console, header, success, error, warning, section
+from aipass.cli.apps.modules import console, header, success, error
 from aipass.api.apps.handlers.json import json_handler
 from aipass.api.apps.handlers.auth import keys, env
-from aipass.api.apps.handlers.config import provider
 
 
 def print_introspection():
@@ -110,7 +109,8 @@ def get_key(args: List[str]):
 
     if api_key:
         success(f"API key retrieved for {provider_name}")
-        console.print(f"  Key (first 20 chars): {api_key[:20]}...")
+        masked = api_key[:6] + "****" + api_key[-4:] if len(api_key) > 10 else "****"
+        console.print(f"  Key: {masked}")
     else:
         error(f"Failed to retrieve API key for {provider_name}")