feat: v2.5.0 - disable_thinking, reasoning models, MIT license, security hardening

Features:
- disable_thinking toggle (issue #11) with per-provider semantics:
  OpenAI classic gets /no_think soft-switch, OpenAI reasoning gets
  reasoning_effort=low, DeepSeek gets both, Anthropic no-op (thinking
  opt-in), Gemini 2.5+ gets thinking_budget=0
- OpenAI reasoning model support (o1/o3/o4-mini/gpt-5 family):
  max_completion_tokens, developer role, reasoning_effort
- Per-request disable_thinking override in ask_question service
- Provider-specific temperature clip (Anthropic 0-1, others 0-2)

Security:
- Require API key re-entry on provider change (OptionsFlow)
- Validate Anthropic json_schema before system-prompt concatenation
- Symlink protection in history file operations
- Hardened secret redaction regexes (sk-*, AIza*, x-api-key)
- get_history service: hard cap on limit (default 10, max 100)

Reliability:
- Retry on 502/503/504 in addition to 429/timeout
- Honor Retry-After header on 429
- Exception chaining (raise ... from err)
- _strip_think_blocks handles nested/dangling tags
- normalize_name sha256 fallback for empty-collapse inputs

UI/housekeeping:
- api_key uses TextSelector(type=PASSWORD)
- DeviceInfo entry_type=SERVICE
- Services unregister on last entry unload
- Dependabot for GitHub Actions
- persist-credentials=false in checkout steps
- manifest requirements pinned with upper bounds
- Ignore docs/plans/ (working artifacts)

License: PolyForm Noncommercial 1.0.0 -> MIT

No breaking changes: service response shape, sensor attributes,
entity IDs and on-disk formats unchanged.

custom_components/ha_text_ai/metrics.py

@@ -1,7 +1,7 @@
 """
 Metrics management for HA Text AI integration.
 
-@license: PolyForm Noncommercial 1.0.0 (https://polyformproject.org/licenses/noncommercial/1.0.0)
+@license: MIT (https://opensource.org/licenses/MIT)
 @author: SMKRV
 @github: https://github.com/smkrv/ha-text-ai
 @source: https://github.com/smkrv/ha-text-ai
@@ -123,13 +123,26 @@ class MetricsManager:
         await self._save_metrics()
 
         error_msg = str(error)
-        # Strip URLs, API keys, tokens, and query parameters from error messages
+        # Strip URLs, API keys, tokens, and query parameters from error messages.
+        # Patterns use word boundaries and explicit length bounds so that
+        # overly greedy matches don't accidentally swallow adjacent text.
         error_msg = re.sub(r'https?://\S+', '[URL]', error_msg)
         error_msg = re.sub(r'[?&]key=[^\s&]+', '?key=***', error_msg)
-        error_msg = re.sub(r'AIza[A-Za-z0-9_-]+', '***', error_msg)
-        error_msg = re.sub(r'Bearer\s+\S+', 'Bearer ***', error_msg)
-        error_msg = re.sub(r'sk-[A-Za-z0-9_-]{20,}', '***', error_msg)
-        error_msg = re.sub(r'x-api-key:\s*\S+', 'x-api-key: ***', error_msg, flags=re.IGNORECASE)
+        # Google API key: fixed prefix + 30+ url-safe chars, bounded by non-key char.
+        error_msg = re.sub(
+            r'AIza[A-Za-z0-9_\-]{30,}(?=[^A-Za-z0-9_\-]|$)', '***', error_msg
+        )
+        # Anthropic / OpenAI / DeepSeek format: "sk-..." (anchors on word boundary).
+        error_msg = re.sub(r'\bsk-[A-Za-z0-9_\-]{20,}\b', '***', error_msg)
+        # Bearer tokens: header-style and JSON-embedded ("Bearer xxx").
+        error_msg = re.sub(r'[Bb]earer\s+[A-Za-z0-9_\-\.=]+', 'Bearer ***', error_msg)
+        # x-api-key header in any case, both raw and JSON-serialized forms.
+        error_msg = re.sub(
+            r'"?x-api-key"?\s*[:=]\s*"?[A-Za-z0-9_\-\.]+"?',
+            'x-api-key: ***',
+            error_msg,
+            flags=re.IGNORECASE,
+        )
         if len(error_msg) > 256:
             error_msg = error_msg[:256] + "..."