docs: add Xquik example and redact startup secrets

[kriptoburak]

Summary

• add a Xquik OpenAPI example using https://xquik.com/openapi.json
• map XQUIK_API_KEY to the native x-api-key header flags
• retain focused Tweets and Trends tag filters
• redact API keys, custom headers, and authenticated spec URLs
• remove remote response bodies from startup errors

Xquik is an independent third-party service. Not affiliated with X Corp. "Twitter" and "X" are trademarks of X Corp.

Repository Fix

Startup previously logged the full configuration, resolved API key, and raw REQUEST_HEADERS value. Authenticated specification URLs and non-200 response bodies could also expose credentials. The revised summaries retain useful non-secret metadata. Parser logs and errors remove URL userinfo and queries. Tests cover direct keys, environment keys, custom headers, spec credentials, query tokens, and response secrets.

Validation

• go mod tidy with no module diff
• go test ./...
• go test -race ./...
• go vet ./...
• go build ./...
• git diff --check
• live Xquik OpenAPI 3.1 verification for Tweets and Trends

No repository license file or detected license metadata was found. This contribution adds no vendored code or generated assets.

[kriptoburak]

Updated the branch with commit 2bf9f88.

The PR now includes an independent security repair: startup no longer logs the resolved API key, the full configuration containing a direct key, or raw custom request headers. The new redacted summary keeps operationally useful counts and non-secret fields, with tests covering direct and environment-based key configuration.

The Xquik example also carries the required independent-service disclosure. The full Go suite, race detector, vet, module tidiness, diff checks, and live OpenAPI tag verification pass.

[kriptoburak]

Published signed repair commit 9808c8d.

The security fix now also redacts userinfo and query tokens from authenticated spec URLs. Parser errors no longer include non-200 response bodies. The new regression covers URL credentials, query tokens, and response secrets.

Fresh validation on the exact head:

• go test ./...
• go test -race ./...
• go vet ./...
• go mod tidy with no module diff
• go build ./...
• live Xquik OpenAPI 3.1 checks for Trends and Tweets

The PR is mergeable. GitHub CI still requires maintainer approval before any job can run.