Keep one URL credential stripper: utils::redact::strip_url_credentials is dead while VEX and upstream npm use vex::product's copy #1848

[agent] Filed by the scheduled architecture audit (audit-core). Register: register.

Kind: refactor. Register ID: A20.

Problem

utils::redact has a public strip_url_credentials and url_userinfo: redact.rs L232-L280. Neither has a caller anywhere in crates/ outside its own test.

Its module doc says the VEX product @id uses it: redact.rs L22-L24. In fact the @id uses vex::product::strip_url_query_fragment + strip_url_userinfo: product.rs L713-L748. patch/redirect/upstream/npm.rs L158 reaches into vex::product for that helper.

The two copies differ:

• redact keeps non-secret query parameters, while the vex copy drops the whole query and fragment;
• the vex copy ends the authority at the first / only, while redact also stops at ? and #.

Proposed change

• Move strip_url_userinfo (and strip_url_query_fragment, if still needed) into utils::redact.
• Point vex::product and redirect/upstream/npm.rs at it.
• Delete the dead strip_url_credentials/url_userinfo and their test.
• Fix the module doc.

Keep vex's current output bytes: the @id shape is user-visible.

Size

3 files. About −50 lines.

Acceptance criteria

• VEX product-id tests and the upstream npm registry tests pass unchanged.
• One test in redact covers https://u:p@host/x?y#z and https://u@host?x (authority ending at ?) through the surviving helper.