fix(ui): handle TOML triple-quotes in arrays and AST-aware JSON keys

PR-Agent on #1248 flagged two remaining sensitive-mask edge cases:

1. The TOML array walker stepped through triple-quoted strings one
   single quote at a time. With a body containing both quotes and
   structural characters, like """abc"]xyz""", a stray `]` inside the
   string body could escape the string-skip pair and terminate the
   array scan early. Add skipTomlString that recognizes triple-quoted
   strings ("""…""", '''…''') and skips them as one unit.

2. The JSON regex matched any "...":  pattern, so substrings inside
   escaped value strings, like "description": "use \\"API_KEY\\": header",
   could mask unrelated text. Replace the JSON branch with a state-aware
   scanner that only registers a string as a key when it sits at an
   object-key position (preceded by `{` or `,`, followed by `:`).

Adds regression tests for both cases.

ui/tests/unit/components/ui/code-editor.test.tsx

@@ -131,6 +131,34 @@ describe('CodeEditor', () => {
     expect(masked).not.toContain('ok');
   });
 
+  it('does not terminate TOML array masking on a `]` inside a triple-quoted string', () => {
+    const value = ['AUTH_TOKEN = [', '  """abc]xyz""",', '  "second",', ']', 'visible = "ok"'].join(
+      '\n'
+    );
+
+    const { container } = render(<CodeEditor value={value} onChange={vi.fn()} language="toml" />);
+    const masked = Array.from(container.querySelectorAll('.cm-sensitive-mask'))
+      .map((el) => el.textContent ?? '')
+      .join('');
+    expect(masked).toContain('abc]xyz');
+    expect(masked).toContain('"second"');
+    expect(masked).not.toContain('ok');
+  });
+
+  it('ignores JSON pseudo-keys embedded inside escaped value strings', () => {
+    const value = '{"description": "use \\"API_KEY\\": header", "API_KEY": "real-secret"}';
+
+    const { container } = render(<CodeEditor value={value} onChange={vi.fn()} language="json" />);
+    const masked = Array.from(container.querySelectorAll('.cm-sensitive-mask'))
+      .map((el) => el.textContent ?? '')
+      .join('');
+    // Only the real API_KEY value gets masked, not the embedded `API_KEY` text
+    // inside the `description` value.
+    expect(masked).toContain('real-secret');
+    expect(masked).not.toContain('use ');
+    expect(masked).not.toContain('header');
+  });
+
   it('does not terminate TOML array masking on a `]` inside a comment', () => {
     const value = [
       'AUTH_TOKEN = [',