AUTHENTICATION_EXPOSE_IN_FETCH_INSTANCES=false does not mask instance token

[adm01-debug]

Summary: With AUTHENTICATION_EXPOSE_IN_FETCH_INSTANCES=false, GET /instance/fetchInstances still returns the instance token field. Only apikey/hash are masked.

Environment: Evolution API v2.3.7, env AUTHENTICATION_EXPOSE_IN_FETCH_INSTANCES=false.

Endpoint: GET /instance/fetchInstances

Expected behavior: When the flag is false, sensitive authentication material (apikey, hash, token) should be omitted or masked from the response.

Actual behavior: The response still contains the full token (a 36-char UUID) for each instance. Verified live on v2.3.7 with the flag set to false: { hasToken: true, tokenLen: 36, hasApiToken: false, hasHash: false, hasApikey: false } — hash and apikey are suppressed, but token is not.

Repro steps:

1. Start the API with AUTHENTICATION_EXPOSE_IN_FETCH_INSTANCES=false.
2. GET /instance/fetchInstances with the global apikey header.
3. Inspect the JSON: each instance still includes a token field with the full instance token.

Impact: Instance tokens (which grant session-level access) are exposed even when the operator explicitly disables exposure in fetchInstances.