Three low-severity hardening items for credential exposure and the setup server. Batch them.

a. setup server has no idle/absolute timeout

cmd/setup.go:122-128 — done is closed only on explicit "Save & Exit". Close the browser tab and srv.Serve runs until Ctrl+C, indefinitely widening the CSRF window. Fix: absolute deadline / idle shutdown (e.g. N minutes).

b. maskKey reveals first+last 4 chars and exact length

internal/client/client.go:139-143

return key[:4] + strings.Repeat("*", len(key)-8) + key[len(key)-4:]

Exposes 8 chars and the precise length in --debug output users tend to share. Fix: fixed-width mask (e.g. syl_****) revealing neither.

c. install.sh installs anyway when no checksum tool is found

install.sh:62-68 warns and falls through to install when neither sha256sum nor shasum exists (fail-open). Downloads are HTTPS and the checksum file is co-hosted/unsigned, so this is the standard curl|sh trust model — low severity. Fix: abort instead of warn.

Effort: S total.