Fix PR #166 review items: import placement and proxy credential redaction

[RichardAtCT]

Follow-up from PR #166 (proxy fix)

Two review items from PR #166 that should be addressed after merge:

1. Move import os to module top-level

src/bot/core.py — import os is inside a method body. Move to top-level imports (it may already be imported there).

2. Redact proxy credentials before logging

src/bot/core.py — The proxy URL is logged verbatim, which could expose credentials if the URL contains user:pass@host:port. Add redaction:

from urllib.parse import urlparse
parsed = urlparse(proxy_url)
safe = parsed._replace(password="***").geturl() if parsed.password else proxy_url
logger.info("Proxy configured", proxy=safe)

3. (Optional) Add test coverage

A unit test that mocks os.environ with HTTPS_PROXY set and asserts builder.proxy() is called.

Ref: #166 (comment)