fix: three fixes that only appeared to work — redaction, timezone, --watch

[sylvesterdamgaard]

Each of these shipped with a green test that asserted the wrong thing.

The API redacted secrets by name, and the exemption for frontend-published
variables (VITE_, NEXT_PUBLIC_, MIX_, REACT_APP_, …) returned BEFORE the
secret-word check — the opposite of what the comment directly above it claimed.
GET /api/v1/processes/{name} therefore served VITE_DB_PASSWORD,
NEXT_PUBLIC_API_SECRET and MIX_PUSHER_APP_SECRET in cleartext. Naming a password
VITE_DB_PASSWORD is a mistake; publishing its value is not the way to point that
out. The exemption now yields to an unambiguous secret word — password, secret,
token, private_key, passphrase, salt — while still ignoring the merely key-ish
ones a genuinely publishable key carries, so NEXT_PUBLIC_API_KEY, VITE_API_URL
and STRIPE_PUBLISHABLE_KEY stay readable.

schedule_timezone never took effect. NewScheduledJobWithOptions built the
CRON_TZ-prefixed spec correctly and stored the parsed schedule on the job — and
then the scheduler registered the RAW expression with cron.AddJob, which
re-parsed it in the cron instance's own default location. The parsed schedule
was computed, stored, and used nowhere. A job configured for
America/New_York fired at 03:00 UTC instead of 08:00. The existing test was
green because it asserted on that dead field; the new one goes through the
Scheduler and reads back the entry the cron library will actually fire.

--watch was a no-op for a symlinked config on Linux. filepath.Abs does not
resolve symlinks, so the directory watch landed on the LINK's directory, where
nothing ever changes — the shape you get from /etc/cbox-init/cbox-init.yaml
pointing into a mounted volume, or from a Kubernetes ConfigMap's ..data
indirection. Both directories are now watched, since which one sees the event
depends on the shape: a plain symlink changes at the target, while a ConfigMap
update swaps the ..data link beside the link itself. macOS's kqueue backend
follows the symlink and hid this entirely, so the test asserts the watch list
structurally as well as behaviourally.