Mask target config on the source detail page (closes #113)

The page rendered the stored target config verbatim, exposing the Slack
incoming-webhook URL, which is a bearer credential: anyone holding it can
post to the channel indefinitely, and it cannot be scoped or revoked
per-holder.

Target config now reaches the template only as a TargetView carrying
labelled fields, so no code path can render the raw blob. maskURL keeps
scheme and host and elides the path, and drops query, fragment and
userinfo; every parse failure yields a neutral placeholder rather than
falling back to the stored string. HTTP header values are never rendered,
only a count.

Rendering change only: the stored config format and the delivery path are
unchanged.

templates/source_detail.html

@@ -145,8 +145,11 @@
                             </form>
                         </div>
                     </div>
-                    {{if .Config}}
-                    <code class="text-xs text-gray-500 break-all block mt-1">{{.Config}}</code>
+                    {{range .Config}}
+                    <div class="text-xs text-gray-500 break-all mt-1">
+                        <span class="font-medium text-gray-700">{{.Label}}:</span>
+                        <span>{{.Value}}</span>
+                    </div>
                     {{end}}
                 </div>
                 {{else}}