fix(zigbee): sanitize MQTT error messages to prevent credential leakage

aiomqtt/paho exception strings can include the broker URI with embedded
credentials (mqtt://user:pass@host) or auth detail. The 502 response
from /import and the message field on /test-connection echoed these
verbatim via str(exc).

- Add _sanitize_mqtt_error() that maps known patterns (auth, refused,
  DNS, TLS, timeout) to coarse, credential-free categories
- Original exception still logged at WARNING level for operator debug
- Drop hostname:port from TimeoutError messages
- /test-connection unexpected-error path no longer interpolates exc

Tests: 6 new (auth/refused/DNS/TLS/unknown sanitization, end-to-end
fetch_networkmap leak check).

backend/app/api/routes/zigbee.py

@@ -78,6 +78,6 @@ async def test_zigbee_connection(
         raise HTTPException(status_code=500, detail=str(exc)) from exc
     except (ConnectionError, TimeoutError) as exc:
         return ZigbeeTestConnectionResponse(connected=False, message=str(exc))
-    except Exception as exc:
+    except Exception:
         logger.exception("Unexpected error during connection test")
-        return ZigbeeTestConnectionResponse(connected=False, message=f"Unexpected error: {exc}")
+        return ZigbeeTestConnectionResponse(connected=False, message="Unexpected error")