Add json:"-" to PostgresConfig.Pass, OIDCConfig.ClientSecret, and CLIConfig.APIKey so they are excluded from json.Marshal output (e.g. the /debug/config endpoint).