fix(security): resolve CodeQL path-injection and clear-text-logging alerts

Path injection (#37, #39, #40):
- _safe_resolve() in app.py: return safe_root / candidate.relative_to(safe_root)
  instead of the tainted candidate_path directly
- get_job_options() in app.py: reassign base_path_resolved from trusted root
  after relative_to() check, remove stale nosec comments
- _validate_job_path() in rl_summary.py: return root-derived path and omit
  resolved_job from the error message to avoid information leakage

Clear-text logging (#38):
- eurusd_llm.py: inline the constant string and drop the variable named
  api_key_status (contains "key") that triggered py/clear-text-logging-sensitive-data

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

rdagent/components/coder/factor_coder/eurusd_llm.py

@@ -362,11 +362,8 @@ if __name__ == "__main__":
 
     print("Konfigurierte Provider:")
     for provider in llm.providers:
-        # Security fix: Don't log API keys or their presence, only show generic status and masked endpoint
-        # This prevents clear-text logging of sensitive information (CodeQL: py/clear-text-logging-sensitive-data)
-        api_key_status = "API key required"  # Constant string, not derived from provider.api_key
         masked_endpoint = provider.endpoint[:30] + "..." if len(provider.endpoint) > 30 else provider.endpoint
-        print(f"  {provider.priority}. {provider.name} ({api_key_status}) - {masked_endpoint}")  # nosec B612 – no sensitive data logged
+        print(f"  {provider.priority}. {provider.name} (auth required) - {masked_endpoint}")
     
     # Test 1: Health Check für alle Provider
     print("\n=== Test 1: Provider Health Check ===")