fix(redact): only credential-shaped stems make an id key secret

SecretId, KeyId and token_id name AWS secrets, KMS keys and records, not key material; require the stem before _id/_account to be a credential key shape (api_token, aws_access_key). Document the key/value placeholder shapes and the shell-stdin key gate.