feat(privacy): scan ingested sources for customer-identifying data

Detection-only scan (internal/privacy) attached to every AnalysisResult:
a customer-domain guess plus a findings list (category, file, line, match,
hint), ported from the KB grep playbook. Runs on archive uploads and the
serialized Redfish tree; gated by LOGPILE_PRIVACY_SCAN (default on).

Surfaced at GET /api/privacy-scan, in the "Customer data" UI panel, and as
privacy_report.json in the raw-export bundle. IP policy keeps RFC1918 and
example ranges out of findings; allowlist covers standards-body and vendor
infrastructure domains. No customer tokens in the repo. See ADL-066 and
bible-local/docs/privacy-scan.md.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

bible-local/03-api.md

@@ -152,6 +152,13 @@ Returns normalized parse and collection issues combined from:
 - raw-export collect logs
 - derived partial-inventory warnings
 
+### `GET /api/privacy-scan`
+
+Returns the customer-data scan for the current dataset (`models.PrivacyScan`:
+`files_scanned`, `customers[]`, `findings[]`, `summary`).
+Returns `{ "loaded": false }` when nothing is loaded or the scan produced
+nothing. Detection only; see `docs/privacy-scan.md`.
+
 ### `GET /api/parsers`
 
 Returns registered parser metadata.
@@ -184,6 +191,7 @@ Current implementation emits a ZIP bundle containing:
 - `raw_export.json`
 - `collect.log`
 - `parser_fields.json`
+- `privacy_report.json` (only when the customer-data scan produced findings)
 
 ### `GET /api/export/reanimator`