Add credential redaction and markdown export

[jrzmurray]

Builds on #29. That PR's page-text-extraction fixes are included in this branch and are a hard dependency: without the TextExtendedAscii latin-1 decode, Mac-authored sections are garbled by the existing UTF-16 decode before the exporter ever sees them (~16% of output comes back as CJK noise and hex dumps). Merge #29 first and this diff reduces to just the feature.

What this adds

An opt-in credential redaction pass that applies to every output mode, and a markdown text export for .one sections.

pyonenote -r -f section.one            # default dump, redacted
pyonenote -r -j -f section.one         # JSON, redacted
pyonenote -m -f notebook/ -o out/      # export section text to markdown
pyonenote -r -m -f notebook/ -o out/   # markdown, redacted

Redaction (-r, off by default)

Replaces credentials with visible [redacted:*] markers. Deliberately precise rather than aggressive:

• Matched: prefix/structure-keyed vendor sentinels (AWS, GitHub, GitLab, OpenAI/Anthropic, Slack, Stripe, Google, npm, PyPI, SendGrid, Twilio, JWT, Bearer) and PEM PRIVATE KEY blocks.
• Deliberately not matched: public certificates, public keys, and CSRs — they are meant to be shared and carry no secret. And there is no generic entropy, keyword-proximity, or base64/blob detection, so ordinary note text, identifiers, and embedded data (images, encoded content) are untouched. The pass is effectively free of false positives.

Coverage is complete, not partial. -r applies to the default dump, JSON (-j), markdown (-m), and text attachments written to --output-dir. Binary attachments (images, Office docs) have no text to scrub and are written byte-identical. The redaction summary goes to stderr so it cannot corrupt JSON on stdout.

Markdown export (-m)

There was no direct path to the plain readable text of a notebook, and revision noise made naive extraction unusable: OneNote keeps every historical revision of a page inline, so a section's property stream repeats each page 2-20x. get_pages() segments on jcidPageNode, titles each page via its CachedTitleString, and collapses revisions to one entry each (de-dup is scoped per title, so genuinely distinct pages that share text are preserved). Text runs are read per platform — RichEditTextUnicode (Windows) and TextExtendedAscii (Mac) — and joined into one .md per section.

Tests

tests/test_redact.py — stdlib unittest, no new dependencies:

python3 -m unittest discover -s tests

Covers full-span key redaction (a partial match that leaves half a live key behind is worse than none), public-certificate preservation, nested property-tree scrubbing, and binary attachment passthrough.

Scope

Both flags are additive and opt-in; no existing output or behavior changes.