fix(ui): honor TOML quoted keys and escaped quotes in sensitive masking

Two remaining gaps in the sensitive-value detector flagged by PR-Agent
on #1248:

1. The TOML/YAML key regex only matched bare keys, so values written
   under quoted keys like `"API_KEY" = "secret"` were never masked.
   Accept basic-string and literal-string quoted keys and normalize the
   captured key (strip quotes, unescape) before isSensitiveKey.

2. The string-skip helper used indexOf for the next quote character, so
   a value like `AUTH_TOKEN = ["a \"quoted\" value", "x"]` could
   terminate scanning early and leak unrelated text or under-mask the
   secret. Introduce skipString that honors backslash escapes for basic
   strings and is used by both the TOML array walker and the JSON
   balanced-brace walker.

Adds regression tests for both edge cases.

ui/tests/unit/components/ui/code-editor.test.tsx

@@ -120,6 +120,30 @@ describe('CodeEditor', () => {
     expect(masked).not.toContain('visible');
   });
 
+  it('masks values whose key uses a TOML quoted-key form', () => {
+    const value = ['"API_KEY" = "supersecret"', 'visible = "ok"'].join('\n');
+
+    const { container } = render(<CodeEditor value={value} onChange={vi.fn()} language="toml" />);
+    const masked = Array.from(container.querySelectorAll('.cm-sensitive-mask'))
+      .map((el) => el.textContent ?? '')
+      .join('');
+    expect(masked).toContain('supersecret');
+    expect(masked).not.toContain('ok');
+  });
+
+  it('respects escaped quotes inside TOML array values when masking', () => {
+    const value = ['AUTH_TOKEN = ["a \\"quoted\\" value", "x"]', 'visible = "ok"'].join('\n');
+
+    const { container } = render(<CodeEditor value={value} onChange={vi.fn()} language="toml" />);
+    const masked = Array.from(container.querySelectorAll('.cm-sensitive-mask'))
+      .map((el) => el.textContent ?? '')
+      .join('');
+    // The closing bracket must be reached; both array members and the
+    // unrelated `visible` line stay on their respective sides of the mask.
+    expect(masked).toContain('"x"');
+    expect(masked).not.toContain('ok');
+  });
+
   it('masks an entire multi-line TOML array value bound to a sensitive key', () => {
     const value = ['AUTH_TOKEN = [', '  "first",', '  "second",', ']', 'visible = "ok"'].join('\n');