Redact secrets and define telemetry retention and deletion

[4nass]

Problem

runs.request, provider errors and metadata can contain credentials, private URLs, customer data or pasted secrets. A mobile gateway also risks echoing those values into channel notifications.

Acceptance criteria

• Apply deterministic redaction before persistence and before outbound notifications.
• Cover common token/key formats plus project-configured patterns without logging the original match.
• Store only the minimum request/error/context metadata needed for operation.
• Define configurable retention by data class: runs, calls, events, diffs and attachments.
• Provide deletion by run, session and project with auditable tombstone semantics.
• SQLite and artifact directories use restrictive permissions and documented backup handling.
• Redaction runs before any diagnostic exception is serialized.
• Tests use canary secrets to prove they never reach SQLite, logs or mobile payloads.

[4nass]

Delivery update

Implemented in PR #58:

• deterministic redaction before persistence, diagnostics and outbound rendering;
• built-in and project-configured token/key patterns;
• configurable retention and auditable tombstone deletion by run, session and project;
• owner-only SQLite permissions and secure artifact-directory helpers;
• tests, documentation and ADR updates.

Validation: 797 tests passed, with two pre-existing collection warnings.

Residual: remaining storage, encryption and external-backup scope is tracked by #38. Remote readiness evidence remains tracked by #49.