fix: correct auth issues in amplitude, livestorm, mixpanel, onesignal

- amplitude: mask api_key in dry-run body output
- livestorm: add missing Bearer prefix to Authorization header
- mixpanel: mask token/$token in dry-run ingestion body output
- onesignal: change auth from 'Key' to 'Basic' per OneSignal REST API docs

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tools/clis/onesignal.js

@@ -16,7 +16,7 @@ if (!APP_ID) {
 
 async function api(method, path, body) {
   const headers = {
-    'Authorization': `Key ${REST_API_KEY}`,
+    'Authorization': `Basic ${REST_API_KEY}`,
     'Content-Type': 'application/json',
     'Accept': 'application/json',
   }