fix(audit): correct v1.4.0 findings (6 items)

- FINDING-001: add activity column rendering in render_dashboard loop
- FINDING-002: map YAML 'token' key to 'auth' in _resolve_config
- FINDING-003/SEC-001: reject tokens containing unresolved ${...} refs
- FINDING-004: add tests for activity column rendering
- FINDING-006: strengthen test_main_columns_help assertions
- SEC-002: enrich timeout warning with collected items count

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tests/test_display.py

@@ -529,3 +529,29 @@ class TestParseColumns:
         assert "test" in output
         assert "Description" not in output
         assert "Release" not in output
+
+    def test_render_dashboard_activity_column(self):
+        """Activity column renders relative date from last_commit_date."""
+        from gitea_dashboard.display import render_dashboard
+
+        console, buf = _make_console()
+        repos = [_make_repo(name="active-repo", last_commit_date="2026-03-10T14:30:00Z")]
+
+        render_dashboard(repos, console=console, columns=["name", "activity"])
+        output = buf.getvalue()
+
+        assert "Activite" in output
+        assert "active-repo" in output
+        assert "il y a" in output or "aujourd'hui" in output
+
+    def test_render_dashboard_activity_column_no_commit(self):
+        """Activity column shows dash when no commit date."""
+        from gitea_dashboard.display import render_dashboard
+
+        console, buf = _make_console()
+        repos = [_make_repo(name="empty-repo", last_commit_date=None)]
+
+        render_dashboard(repos, console=console, columns=["name", "activity"])
+        output = buf.getvalue()
+
+        assert "\u2014" in output or "\u2014" in output