feat(privacy): scan ingested sources for customer-identifying data

Detection-only scan (internal/privacy) attached to every AnalysisResult:
a customer-domain guess plus a findings list (category, file, line, match,
hint), ported from the KB grep playbook. Runs on archive uploads and the
serialized Redfish tree; gated by LOGPILE_PRIVACY_SCAN (default on).

Surfaced at GET /api/privacy-scan, in the "Customer data" UI panel, and as
privacy_report.json in the raw-export bundle. IP policy keeps RFC1918 and
example ranges out of findings; allowlist covers standards-body and vendor
infrastructure domains. No customer tokens in the repo. See ADL-066 and
bible-local/docs/privacy-scan.md.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

internal/parser/parser.go

@@ -3,10 +3,12 @@ package parser
 import (
 	"fmt"
 	"io"
+	"os"
 	"strings"
 	"time"
 
 	"git.mchus.pro/mchus/logpile/internal/models"
+	"git.mchus.pro/mchus/logpile/internal/privacy"
 )
 
 // BMCParser parses BMC diagnostic archives using vendor-specific parsers
@@ -66,6 +68,9 @@ func (p *BMCParser) parseFiles() error {
 	result.Filename = p.result.Filename
 
 	appendExtractionWarnings(result, p.files)
+	if scan := runPrivacyScan(p.files); scan != nil {
+		result.PrivacyScan = scan
+	}
 	if result.CollectedAt.IsZero() {
 		if ts := inferCollectedAtFromExtractedFiles(p.files); !ts.IsZero() {
 			result.CollectedAt = ts.UTC()
@@ -76,6 +81,28 @@ func (p *BMCParser) parseFiles() error {
 	return nil
 }
 
+// PrivacyScanEnabled reports whether the customer-data scan runs. It is on by
+// default and disabled by LOGPILE_PRIVACY_SCAN=0 / false.
+func PrivacyScanEnabled() bool {
+	switch strings.ToLower(strings.TrimSpace(os.Getenv("LOGPILE_PRIVACY_SCAN"))) {
+	case "0", "false", "off", "no":
+		return false
+	default:
+		return true
+	}
+}
+
+func runPrivacyScan(files []ExtractedFile) *models.PrivacyScan {
+	if !PrivacyScanEnabled() {
+		return nil
+	}
+	in := make([]privacy.File, 0, len(files))
+	for _, f := range files {
+		in = append(in, privacy.File{Path: f.Path, Content: f.Content})
+	}
+	return privacy.Scan(in)
+}
+
 func inferCollectedAtFromExtractedFiles(files []ExtractedFile) time.Time {
 	var latestReliable time.Time
 	var latestAny time.Time