Redact secrets and enforce telemetry retention (#35)

[4nass]

Summary

• add deterministic built-in and project-configured secret redaction
• redact requests, provider results, diagnostics, job events, approvals and outbound-ready summaries before persistence
• add configurable retention policy and auditable tombstone deletion by run/session/project
• enforce owner-only permissions on SQLite stores and provide secure artifact-directory helper
• document backup handling and remaining artifact-store scope (Securely ingest mobile attachments, logs, screenshots and voice transcripts #38)

Closes #35.

Validation

• /home/anass/.local/bin/uv run pytest -q
• 797 passed, 2 pre-existing collection warnings

[4nass]

Status

Delivered: deterministic redaction, configurable retention, auditable tombstone deletion, owner-only SQLite permissions, artifact helpers, tests and documentation.

Residual: storage/encryption and external-backup scope remains in #38; remote readiness evidence remains in #49.

Closes #35 is present in the PR description.