fix: address protocol probe review findings

internal/profile/profile.go

@@ -271,6 +271,13 @@ func RedactText(value string) string {
 	return credentialPattern.ReplaceAllString(value, `${1}${2}:REDACTED@`)
 }
 
+// RedactUserinfoText removes usernames as well as passwords. Form frames use
+// this stricter boundary because even the identity of the probe source is
+// private while a Profile is being edited.
+func RedactUserinfoText(value string) string {
+	return credentialPattern.ReplaceAllString(value, `${1}REDACTED@`)
+}
+
 func ObscureURL(value string) string {
 	u, err := url.Parse(value)
 	if err != nil || u.User == nil {
@@ -283,9 +290,9 @@ func ObscureURL(value string) string {
 	return u.String()
 }
 
-// ObscureURLForEditing masks only password runes while preserving the input's
+// ObscureURLForEditing masks every userinfo rune while preserving the input's
 // rune count. A text input clone can therefore retain its real cursor and
-// horizontal viewport positions without ever rendering the credential.
+// horizontal viewport positions without rendering either username or password.
 func ObscureURLForEditing(value string) string {
 	matches := credentialPattern.FindAllStringSubmatchIndex(value, -1)
 	if len(matches) == 0 {
@@ -294,10 +301,10 @@ func ObscureURLForEditing(value string) string {
 	var masked strings.Builder
 	last := 0
 	for _, match := range matches {
-		passwordStart, passwordEnd := match[6], match[7]
-		masked.WriteString(value[last:passwordStart])
-		masked.WriteString(strings.Repeat("•", len([]rune(value[passwordStart:passwordEnd]))))
-		last = passwordEnd
+		userinfoStart, userinfoEnd := match[4], match[7]
+		masked.WriteString(value[last:userinfoStart])
+		masked.WriteString(strings.Repeat("•", len([]rune(value[userinfoStart:userinfoEnd]))))
+		last = userinfoEnd
 	}
 	masked.WriteString(value[last:])
 	return masked.String()