fix(credentials): address gosec and errcheck lint warnings

- Check read byte count before accessing buffer to fix G602 gosec warnings
- Explicitly discard term.Restore error to fix errcheck warning

Author: sbs44

internal/utils/credentials/input.go

@@ -17,19 +17,19 @@ func PromptMaskedWithAsterisks(stdin *os.File) (string, error) {
 	if err != nil {
 		return "", fmt.Errorf("failed to set raw terminal: %w", err)
 	}
-	defer term.Restore(fd, oldState)
+	defer func() { _ = term.Restore(fd, oldState) }()
 	return readMaskedInput(stdin, os.Stderr)
 }
 
 // readMaskedInput reads bytes one at a time from r, echoing '*' to echo for each
 // printable character. Handles backspace, Ctrl+C, and Enter.
 func readMaskedInput(r io.Reader, echo io.Writer) (string, error) {
 	var buf []byte
-	b := make([]byte, 1)
+	var b [1]byte
 	for {
-		if _, err := r.Read(b); err != nil {
+		if _, err := io.ReadFull(r, b[:]); err != nil {
 			fmt.Fprint(echo, "\r\n")
-			if err == io.EOF {
+			if err == io.EOF || err == io.ErrUnexpectedEOF {
 				return string(buf), nil
 			}
 			return "", fmt.Errorf("failed to read input: %w", err)