[umpireboulianne-design]

Summary

• Add shared URL credential validators hasUrlCredentials() and assertNoUrlCredentials() in packages/sdk/src/network.ts (exported from @sub-rosa/sdk) that reject HTTP/HTTPS URLs containing username or password components without echoing credentials.
• Enforce credential-free RPC/endpoint URLs across SubRosaClient, KeeperStatusClient, keeper configuration (parseKeeperRunConfig, watch, serve), appraisal paid-fetch client (createPaidFetch), and web configuration (validatePublicConfig, resolvePasskeyRpcUrl).
• Add deterministic unit tests in packages/sdk/src/network.test.ts, services/keeper/src/dry-run.test.ts, and apps/web/src/lib/config.test.ts.

Supply-chain review

• No package scripts or dependencies changed. If changed, explain why below.
• No .vscode/, workflow, or other editor/config file changes. If changed, list them below.
• No lockfile changes. If changed, explain the update below.
• No binary or font asset changes. If changed, list and justify them below.
• I confirm no automatic task (such as preinstall/postinstall) was added.
• I confirm no hidden executable payload (encoded blob, obfuscated command, or unexpected binary) was added.
• Any changed executable or binary was reviewed by a maintainer.

Testing

• node --import tsx/esm --test packages/sdk/src/network.test.ts packages/sdk/src/public-api-snapshot.test.ts services/keeper/src/dry-run.test.ts services/appraisal-api/src/config.test.ts apps/web/src/lib/config.test.ts

Closes #538
Fixes #538