fix: security hardening — move meta-ads to header auth, encode URLs

Critical:
- meta-ads: move access_token from URL query string to Authorization
  header to prevent credential leakage in server logs and referrers

Medium (URL encoding):
- g2: encode state and date filter values
- trustpilot: use URLSearchParams for reviews list params
- typeform: encode response IDs in delete endpoint
- demio: encode event type filter
- lemlist: encode email addresses in URL path segments

Docs:
- Fix 6 missing env vars in CLI README auth table
- Fix .gitignore typo (extra space in .DS_Store pattern)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tools/clis/meta-ads.js

@@ -10,16 +10,17 @@ if (!TOKEN) {
 }
 
 async function api(method, path, body) {
-  const separator = path.includes('?') ? '&' : '?'
-  const url = `${BASE_URL}${path}${separator}access_token=${TOKEN}`
-  const opts = { method, headers: {} }
+  const url = `${BASE_URL}${path}`
+  const opts = {
+    method,
+    headers: { 'Authorization': `Bearer ${TOKEN}` },
+  }
   if (body) {
     opts.headers['Content-Type'] = 'application/json'
     opts.body = JSON.stringify(body)
   }
   if (args['dry-run']) {
-    const dryRunUrl = url.replace(TOKEN, '***')
-    return { _dry_run: true, method, url: dryRunUrl, headers: opts.headers, body: body || undefined }
+    return { _dry_run: true, method, url, headers: { ...opts.headers, Authorization: '***' }, body: body || undefined }
   }
   const res = await fetch(url, opts)
   const text = await res.text()