Add reminders about security best practices and redact secrets in logs

[cmoresco-stripe]

Summary

• Adds comments before STRIPE_SECRET_KEY assignments in all server files urging users not to put keys in code and pointing
  to https://docs.stripe.com/keys-best-practices.
• Replaces cat .env in CI workflow files with a redacting version that masks secret keys (sk_), restricted keys (rk_),
  and webhook secrets (whsec_) while leaving publishable keys visible.
• Where applicable (Ruby config_helper.rb): adds a redact_key helper and uses it in error messages so secret keys are
  not printed in full.

What was changed (4 files, 20 insertions):

• mpp/server/node-typescript/main.ts — // comment block before STRIPE_SECRET_KEY check
• mpp/server/python/main.py — # comment block before STRIPE_SECRET_KEY assignment
• x402/server/node-typescript/main.ts — // comment block before STRIPE_SECRET_KEY check
• x402/server/python/main.py — # comment block before STRIPE_SECRET_KEY assignment