Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@qdrant_client/async_qdrant_remote.py`:
- Around line 120-123: The headers merge currently applies user-provided headers
before the client sets "api-key" and "User-Agent", which silently overwrites
user values; update the merging logic in the async_qdrant_remote constructor
(the block that writes to self._rest_headers and self._grpc_headers) to
explicitly handle reserved keys: define a reserved set containing "api-key" and
"User-Agent" and either (A) prevent overrides by checking headers for any
reserved keys and raising a clear ValueError if present, or (B) allow overrides
by applying user headers after the client sets its defaults (i.e., set defaults
first then merge headers), and add matching behavior to the synchronous
implementation; also update the parameter docstring to state the chosen behavior
for reserved headers.

---

Nitpick comments:
In `@qdrant_client/async_qdrant_client.py`:
- Around line 107-112: The constructor currently stores the incoming headers
parameter in self._init_options which is exposed via the public init_options
property, so sensitive header values (e.g., auth tokens) can leak if
init_options is logged or serialized; either avoid exposing raw headers by
removing or redacting the "headers" key from self._init_options before
assignment or implement redaction in the init_options property getter (reference
symbols: the constructor that populates _init_options, the _init_options dict
itself, and the public init_options property) and ensure any logging or
serialization paths use the redacted form.