The type is a map of host to headers, not a flat header set. Name it after
that shape, and rename the fields carrying it to authHeadersByHost so the
lookup step is visible at every call site.
Claude-Session: https://claude.ai/code/session_01KNPMznEzkRpxFZMLisjdqL
Authenticating a remote Taskfile so far meant putting the credential in the
include URL, where it leaks into error messages and the confirmation prompt.
`remote.auth` configures free-form headers per host instead, so the URL stays
safe to commit. Values may reference environment variables with ${VAR}.
The headers are injected by a RoundTripper rather than set on the request:
that covers the HEAD probe RemoteExists issues before the GET, and keeps a
cross-host redirect from carrying the credentials. They are resolved when the
request is about to be made, so a cached or offline run does not require a
token it will never send.
* feat: redact credentials in remote urls
* chore: improve function naming
* fix: TaskfileNotSecureError should use redacted URI
* feat: unexport all node implementation fields
* fix: unexport HTTPNode.url
