feat(privacy): scan ingested sources for customer-identifying data

Detection-only scan (internal/privacy) attached to every AnalysisResult:
a customer-domain guess plus a findings list (category, file, line, match,
hint), ported from the KB grep playbook. Runs on archive uploads and the
serialized Redfish tree; gated by LOGPILE_PRIVACY_SCAN (default on).

Surfaced at GET /api/privacy-scan, in the "Customer data" UI panel, and as
privacy_report.json in the raw-export bundle. IP policy keeps RFC1918 and
example ranges out of findings; allowlist covers standards-body and vendor
infrastructure domains. No customer tokens in the repo. See ADL-066 and
bible-local/docs/privacy-scan.md.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

internal/server/handlers.go

@@ -1199,6 +1199,15 @@ func extractFirmwareComponentAndModel(deviceName string) (component, model strin
 	return deviceName, "-"
 }
 
+func (s *Server) handleGetPrivacyScan(w http.ResponseWriter, r *http.Request) {
+	result := s.GetResult()
+	if result == nil || result.PrivacyScan == nil {
+		jsonResponse(w, map[string]any{"loaded": false})
+		return
+	}
+	jsonResponse(w, result.PrivacyScan)
+}
+
 func (s *Server) handleGetStatus(w http.ResponseWriter, r *http.Request) {
 	result := s.GetResult()
 	if result == nil {