lib.ec.ssh.AsyncSSH: Actually hide password

_connect_kwargs(hide_secrets = True) is used to log the connection
parameters when a connection fails, without leaking the password. The
filtered dictionary is built before the password is replaced with
'<hidden>', and the replacement is applied to the local kwargs
dictionary afterwards, after the filtered copy has already been made.
The dictionary that ends up in the log therefore still contains the
real password.

Hide the password before building the filtered dictionary.

Assisted-by: unsloth/Qwen3.8-27B-GGUF:Q4_K_M with pi.dev v0.84.2
Signed-off-by: Jan Lindemann <jan@janware.com>

src/python/jw/pkg/lib/ec/ssh/AsyncSSH.py

@@ -72,10 +72,9 @@ class AsyncSSH(Base):
         }
         if self.__known_hosts is not _USE_DEFAULT_KNOWN_HOSTS:
             kwargs['known_hosts'] = self.__known_hosts
-        ret = {k: v for k, v in kwargs.items() if v is not None}
         if hide_secrets and 'password' in kwargs:
             kwargs['password'] = '<hidden>'
-        return ret
+        return {k: v for k, v in kwargs.items() if v is not None}
 
     @property
     async def _conn(self) -> asyncssh.SSHClientConnection: