Mask plaintext Mediator API keys in cwrap.py and pwrap.py debug logs #624

While reviewing the distributed study wrappers in tools/cwrap.py and tools/pwrap.py, I noticed that when DEBUG logging is enabled, the scripts print the raw Mediator API key directly into the logs:

• In tools/cwrap.py (L74): logging.debug(f"API Key: {apikey}")
• In tools/cwrap.py (L100): logs the full request URL containing the unmasked key: logging.debug(f'https://www.controlcore.org/pm/{yuyu}{apikey}&fetch={name2}')
• In tools/pwrap.py (L65): logging.debug(f"API Key: {apikey}")

Why this is an issue

In multi-node study runs or shared lab/CI environments, debug logs often get aggregated into files or terminal logs. Having the raw API key from concore.apikey exposed in plaintext creates an unnecessary credential leak.

Proposed fix

Instead of removing the log line completely (which would make it harder for researchers to verify whether an API key was actually loaded), we can add a lightweight masking helper that redacts all but the last 4 characters (e.g. ******1234 or **** for short keys), and sanitize the logged request URLs.

I have already implemented and tested this locally along with unit tests. Happy to open a PR for this if the maintainers agree!