feat(privacy): scan ingested sources for customer-identifying data

Detection-only scan (internal/privacy) attached to every AnalysisResult:
a customer-domain guess plus a findings list (category, file, line, match,
hint), ported from the KB grep playbook. Runs on archive uploads and the
serialized Redfish tree; gated by LOGPILE_PRIVACY_SCAN (default on).

Surfaced at GET /api/privacy-scan, in the "Customer data" UI panel, and as
privacy_report.json in the raw-export bundle. IP policy keeps RFC1918 and
example ranges out of findings; allowlist covers standards-body and vendor
infrastructure domains. No customer tokens in the repo. See ADL-066 and
bible-local/docs/privacy-scan.md.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

web/templates/index.html

@@ -190,6 +190,27 @@
                     </table>
                 </div>
             </section>
+            <section id="privacy-section" class="parse-errors-section hidden">
+                <div class="parse-errors-header" onclick="togglePrivacy()">
+                    <span id="privacy-title">Customer data</span>
+                    <span id="privacy-toggle" class="parse-errors-toggle">▲</span>
+                </div>
+                <div id="privacy-body" class="parse-errors-body">
+                    <div id="privacy-customer" class="privacy-customer"></div>
+                    <table class="parse-errors-table">
+                        <thead>
+                            <tr>
+                                <th>Severity</th>
+                                <th>Category</th>
+                                <th>Location</th>
+                                <th>Match</th>
+                                <th>Hint</th>
+                            </tr>
+                        </thead>
+                        <tbody id="privacy-rows"></tbody>
+                    </table>
+                </div>
+            </section>
         </section>
     </main>