fix: security hardening — move meta-ads to header auth, encode URLs

Critical:
- meta-ads: move access_token from URL query string to Authorization
  header to prevent credential leakage in server logs and referrers

Medium (URL encoding):
- g2: encode state and date filter values
- trustpilot: use URLSearchParams for reviews list params
- typeform: encode response IDs in delete endpoint
- demio: encode event type filter
- lemlist: encode email addresses in URL path segments

Docs:
- Fix 6 missing env vars in CLI README auth table
- Fix .gitignore typo (extra space in .DS_Store pattern)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tools/clis/g2.js

@@ -64,7 +64,7 @@ async function main() {
         case 'list': {
           let qs = `?page[size]=${perPage}&page[number]=${page}`
           if (productId) qs += `&filter[product_id]=${productId}`
-          if (args.state) qs += `&filter[state]=${args.state}`
+          if (args.state) qs += `&filter[state]=${encodeURIComponent(args.state)}`
           result = await api('GET', `/survey-responses${qs}`)
           break
         }
@@ -152,8 +152,8 @@ async function main() {
       switch (sub) {
         case 'visitors': {
           let qs = `?page[size]=${perPage}&page[number]=${page}`
-          if (args.start) qs += `&filter[start_date]=${args.start}`
-          if (args.end) qs += `&filter[end_date]=${args.end}`
+          if (args.start) qs += `&filter[start_date]=${encodeURIComponent(args.start)}`
+          if (args.end) qs += `&filter[end_date]=${encodeURIComponent(args.end)}`
           result = await api('GET', `/tracking-events${qs}`)
           break
         }