Mask the http target's destination URL in the UI (closes #115)

The http target's destination URL can itself be a bearer credential, and
the source detail page rendered it in full. Render it through the
existing MaskURL instead, matching the rule already applied to slack
targets.

Independently reviewed: mutation-verified (reverting to the raw value
fails the absence assertions, not merely the masked-form ones), MaskURL
probed against userinfo, query, fragment, port, IPv6 literal and
non-http schemes, and every sibling path that surfaces target data
re-walked and found clean.

internal/delivery/target_config_view.go

@@ -106,6 +106,12 @@ func slackConfigFields(configJSON string) []ConfigField {
 // and its retry settings. Header values are not shown — they
 // routinely carry authorization tokens — only how many are
 // configured.
+//
+// The destination is masked to scheme and host by the same
+// rule the Slack target uses. An HTTP target's destination is
+// commonly a Slack, Discord or Teams incoming-webhook endpoint
+// whose path segments are the credential, and the field takes
+// an arbitrary URL, so no segment can be assumed non-secret.
 func httpConfigFields(t *database.Target) []ConfigField {
 	cfg, err := parseHTTPConfig(t.Config)
 	if err != nil {
@@ -114,7 +120,7 @@ func httpConfigFields(t *database.Target) []ConfigField {
 
 	fields := []ConfigField{{
 		Label: "Destination URL",
-		Value: cfg.URL,
+		Value: MaskURL(cfg.URL),
 	}}
 
 	if cfg.Timeout > 0 {