Redact bearer tokens from verbose wrapper output

[wnstfy]

Priority: High

Problem: XCLOUD_VERBOSE=1 enables curl -v, which can print the Authorization header.

Acceptance:

• Verbose/debug output never prints bearer tokens.
• Tests cover verbose mode with a fake token.
• Existing non-verbose behavior is unchanged.