fix: redact runtime device credentials

[rogerchappel]

Summary

• strip OpenClaw device private keys and device-token envelopes from browser-facing runtime metadata
• apply the sanitizer to both full runtime DTOs and the runtime list projection
• preserve non-sensitive metadata and capability summaries

Why

Runtime metadata historically included the device private key and is now also the encrypted device-token store. Neither plaintext keys nor credential ciphertext should cross the server API boundary.

Stack

Depends on #709, #708, #707, #706, and #705.

Verification

• pnpm test -- src/lib/runtime-api-dto.test.ts src/app/api/runtimes/route.test.ts src/app/api/runtimes/[id]/route.test.ts
• pnpm exec tsc --noEmit --pretty false --incremental false
• pnpm exec eslint src/lib/runtime-api-dto.ts src/lib/runtime-api-dto.test.ts src/app/api/runtimes/route.ts
• pre-push pnpm typecheck
• pre-push pnpm build
• git diff --check