Keep the Azure Maps tile token when tool results are redacted (0.261.050)

[Paul Lizer (paullizer)]

Summary

Maps an agent draws with the Azure Maps action load their tiles again. Tool results are redacted before they are stored as citations, and the token= rule replaced the map's tile proxy token with ***REDACTED***, so every stored map drew its markers and paths on blank tiles (tile requests returned 400).

Changes

• plugin_invocation_logger.py: _redact_secret_assignment keeps a token= value only where it directly follows /api/azure-maps/tile?. That is where build_tile_proxy_url_template writes the token.
• That token is encrypted with the app's secret key, expires, and only works on SimpleChat's signed-in tile proxy. The Azure Maps key never leaves the server.
• Everything else is still redacted: other token= values, another key after the prefix, a token later in the query, absolute URLs and every other secret.
• Version 0.261.050.

Maps stored before this change keep the redacted token, which cannot be recovered, so they still show no tiles. Running the request again produces a working map.

This follows #1614, which escaped the map attribution and limited tile templates to the proxy. The same fix is in the V2 branch through #1612.

Validation

• New functional_tests/test_azure_maps_tile_token_redaction_fix.py: 3 passed. It loads the real invocation logger and Azure Maps helpers, checks that a map result keeps a token that still decodes (as an object and as JSON text), and checks that every other case is still redacted.
• test_chat_inline_map_attribution_text.py, test_azure_maps_tile_token_refresh_fix.py and test_azure_maps_openlayers_plugin.py: passed (14 with the new test).
• Broken access control checker on the changed lines: passed.
• Verified on a SimpleChat POC deployment running the V2 branch: a newly stored map keeps its token and its tiles load (HTTP 200).

Docs

• Fix doc: docs/explanation/fixes/AZURE_MAPS_TILE_TOKEN_REDACTION_FIX.md.
• Release notes: 0.261.050.