Redact credentials from ExistingTargetConnectionString in MigrationPlan API responses

[JoshLuedeman]

Context

MigrationPlanController.ToResponse() decrypts ExistingTargetConnectionString and includes the full connection string (with password) in every API response. While behind [Authorize], this violates defense-in-depth - credentials can leak through browser DevTools, logs, or response caching.

Proposed Approach

• Add a RedactConnectionString() helper that replaces Password=... with Password=***
• Apply it in ToResponse() instead of SafeUnprotect()
• If frontend needs raw connection string for re-editing, provide a separate endpoint with restrictive caching headers

Priority

Medium. No user-facing breakage, but should ship before any public/multi-tenant deployment.

Found by security-auditor during Phase 4 review (CWE-200).