fix(compaction): failures carry the real error, with endpoint credentials redacted

The pager rendered "Compaction failed." with the error dropped, and the
shell's unsuppressed auto-compaction failure sent an empty error. Both
now carry the decoded first line of the failure (retry guidance plus the
detail), decoded from the ACP data rather than its JSON-escaped Display,
propagated unchanged through the compact extension, capped for a banner.

Endpoint credentials never reach the banner: the sampler redacts the
parsed endpoint (userinfo, sensitive query values, fragment via the
repository sanitizer) in every 401 message and the appended request URL,
and the shell redacts every URL in the error text before line selection,
including URLs whose password holds whitespace or that follow a
multi-byte delimiter.

Ported from upstream 1.0.13 (grok-build dispatch/prompt.rs,
session/compaction.rs), extended with the redaction.

Claude-Session: https://claude.ai/code/session_01RUqV8HVGXcAETyYbZ2tPQ4

crates/codegen/kigi-tui/src/app/dispatch/prompt.rs

@@ -1290,10 +1290,9 @@ pub(super) fn handle_compact_complete(
             }
             Err(err) => {
                 tracing::error!(agent = ?agent_id, error = %err, "Compaction failed");
+                // Already sanitized by the effect layer.
                 agent.scrollback.push_block(RenderBlock::session_event(
-                    SessionEvent::CompactionFailed {
-                        error: String::new(),
-                    },
+                    SessionEvent::CompactionFailed { error: err.clone() },
                 ));
             }
         }