feat(privacy): fold sanitize into the header "Remove personal data" button

Drops the in-panel sanitize sub-block (button + preview table + "already
sanitized" note) that duplicated affordances across the page. The header
"Clear Data" button is renamed "Remove personal data" and now sanitizes the
uploaded file and downloads the clean copy in one click - no preview, no
confirmation. It is shown only when the source can be sanitized, and reads
"Personal data removed" (disabled) when the file already looks de-identified.
The old clearData() teardown is covered by Restart.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

web/static/css/style.css

@@ -1047,60 +1047,3 @@ code {
     color: var(--muted);
 }
 
-.privacy-sanitize {
-    padding: 10px 12px;
-    border-bottom: 1px solid var(--border);
-}
-
-.privacy-sanitize.hidden,
-.privacy-sanitize-preview.hidden {
-    display: none;
-}
-
-#privacy-sanitize-btn,
-.privacy-sanitize-dl {
-    font-size: 0.85em;
-    padding: 5px 12px;
-    cursor: pointer;
-}
-
-.privacy-sanitize-preview {
-    margin-top: 10px;
-    font-size: 0.88em;
-}
-
-.privacy-sanitize-preview table {
-    margin: 6px 0;
-}
-
-.privacy-sanitize-dl {
-    margin-top: 8px;
-    font-weight: 600;
-}
-
-.privacy-sanitize-warn {
-    margin-top: 8px;
-    padding: 6px 8px;
-    background: #fff8f0;
-    border: 1px solid #f0e0c0;
-    border-radius: 4px;
-}
-
-.privacy-sanitize-warn ul {
-    margin: 4px 0 0;
-    padding-left: 18px;
-    font-family: monospace;
-    font-size: 0.82em;
-}
-
-.privacy-sanitize-err {
-    color: var(--crit-fg);
-}
-
-.privacy-sanitized-note {
-    padding: 6px 8px;
-    background: #eef7ee;
-    border: 1px solid #cfe6cf;
-    border-radius: 4px;
-    font-size: 0.88em;
-}