fix(hub): never echo credential material and only use active credentials

[TheGreatAxios]

A stored secret containing CR, LF or NUL made fetch throw a header error that quoted the secret, and the route put that message in the 422 and in onError. Revoked, expired or errored credentials were still decrypted and sent.

Changes

• discoverMcpServer refuses a secret that is not a valid header value (anything outside tab and printable ASCII) with a fixed message, before any request.
• The route passes on only McpError messages; any other cause becomes "the handshake failed", in the response and in onError. The package's own refusals (no API origin, off-origin target, redirect) are McpErrors. The off-origin check now runs in discoverMcpServer before the pinned fetch, with the same message credential-http uses.
• readCredential returns only status: "active" credentials that have not expired; anything else reads as absent (404).
• Tests (each fails before the fix): CRLF, LF and NUL secrets are refused with no request and no secret in the response or onError; a fetch failure reads as a generic handshake error; revoked, errored and expired credentials read as absent.
• README documents the 404 and 422 cases.

Checks

bun run check, bun run build and the Node pack smoke pass locally.

Closes CL-9453