fix(02-03): scrub PHP-escaped JSON secret values

PHP json_encode writes \/ so captured redirect URLs never matched the fixture body, leaving OAuth codes in client sessions.

Co-authored-by: Cursor <cursoragent@cursor.com>

tide/capture_test.go

@@ -55,6 +55,31 @@ func TestCaptureAndPlaceholderResolution(t *testing.T) {
 		t.Fatalf("missing placeholder: %v", err)
 	}
 
+	escaped := Step{
+		ID: "consent",
+		Response: Response{
+			Body: Body(`{"data":{"redirect_to":"http:\/\/127.0.0.1:8424\/oauth\/callback?code=oauthCode99"}}`),
+		},
+		Capture: []CaptureRule{{
+			From:     "response.json",
+			Path:     "$.data.redirect_to",
+			As:       "oauth:redirect",
+			Category: "oauth_code",
+		}},
+	}
+	if err := CaptureStep(store, &escaped); err != nil {
+		t.Fatal(err)
+	}
+	if err := ScrubStep(store, &escaped); err != nil {
+		t.Fatal(err)
+	}
+	if strings.Contains(string(escaped.Response.Body), "oauthCode99") {
+		t.Fatalf("php-escaped redirect still has code: %s", escaped.Response.Body)
+	}
+	if !strings.Contains(string(escaped.Response.Body), "{{oauth:redirect}}") {
+		t.Fatalf("php-escaped redirect not placeholder: %s", escaped.Response.Body)
+	}
+
 	step2 := Step{
 		ID: "pkce",
 		Request: Request{