feat(privacy): scan ingested sources for customer-identifying data

Detection-only scan (internal/privacy) attached to every AnalysisResult:
a customer-domain guess plus a findings list (category, file, line, match,
hint), ported from the KB grep playbook. Runs on archive uploads and the
serialized Redfish tree; gated by LOGPILE_PRIVACY_SCAN (default on).

Surfaced at GET /api/privacy-scan, in the "Customer data" UI panel, and as
privacy_report.json in the raw-export bundle. IP policy keeps RFC1918 and
example ranges out of findings; allowlist covers standards-body and vendor
infrastructure domains. No customer tokens in the repo. See ADL-066 and
bible-local/docs/privacy-scan.md.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

web/static/css/style.css

@@ -1001,3 +1001,48 @@ code {
     color: #7a5200;
     font-weight: 600;
 }
+
+.privacy-customer {
+    padding: 10px 12px;
+    border-bottom: 1px solid var(--border);
+    background: #fff8f0;
+}
+
+.privacy-customer.hidden {
+    display: none;
+}
+
+.privacy-customer-row {
+    margin-bottom: 6px;
+}
+
+.privacy-conf {
+    font-size: 0.8em;
+    text-transform: uppercase;
+    padding: 1px 6px;
+    border-radius: 3px;
+    background: var(--border);
+}
+
+.privacy-conf-high {
+    color: var(--crit-fg);
+    font-weight: 600;
+}
+
+.privacy-conf-medium {
+    color: #7a5200;
+    font-weight: 600;
+}
+
+.privacy-hits {
+    color: var(--muted);
+    font-size: 0.85em;
+}
+
+.privacy-evidence {
+    margin: 4px 0 0;
+    padding-left: 18px;
+    font-family: monospace;
+    font-size: 0.82em;
+    color: var(--muted);
+}