fix: security hardening — move meta-ads to header auth, encode URLs

Critical:
- meta-ads: move access_token from URL query string to Authorization
  header to prevent credential leakage in server logs and referrers

Medium (URL encoding):
- g2: encode state and date filter values
- trustpilot: use URLSearchParams for reviews list params
- typeform: encode response IDs in delete endpoint
- demio: encode event type filter
- lemlist: encode email addresses in URL path segments

Docs:
- Fix 6 missing env vars in CLI README auth table
- Fix .gitignore typo (extra space in .DS_Store pattern)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tools/clis/demio.js

@@ -72,7 +72,7 @@ async function main() {
         case 'list': {
           const type = args.type
           let qs = ''
-          if (type) qs = `?type=${type}`
+          if (type) qs = `?type=${encodeURIComponent(type)}`
           result = await api('GET', `/events${qs}`)
           break
         }