feat(privacy): audited redaction that keeps history's shape and removes its content

Rows in append-only history are never deleted; their content can now be
made irrecoverable through one audited path. A redaction replaces the
content columns of an event, memory, message, model call, belief or
assertion with a fixed marker, keeps identifiers, links, timestamps,
scores and breakdowns, writes an append-only ledger row with a SHA-256 of
the removed content, appends a redaction event, optionally cascades to
derived rows and to the events that quote them, and scrubs stored snapshot
archives before re-signing them. noema_redact() is the only write the
append-only trigger admits, for UPDATE only, under a transaction-local flag
the application never sets; plain updates and all deletes stay refused.
Replay labels redacted stimuli instead of inventing them.

Cryptographic erasure was considered and deferred with reasons (ADR-0009);
docs/privacy.md defines retained, redacted, irrecoverable and deleted and
states what backups and earlier exports are not covered. Migration 0023.

internal/ui/ui.go

@@ -133,6 +133,7 @@ func (u *UI) parse(fsys fs.FS) error {
 		"duration":  func(s int64) string { return (time.Duration(s) * time.Second).Truncate(time.Second).String() },
 		"bytes":     humanBytes,
 		"pct":       func(f float64) string { return fmt.Sprintf("%.0f%%", f*100) },
+		"list":      func(xs ...string) []string { return xs },
 		"conf": func(v any) string {
 			switch x := v.(type) {
 			case float64:
@@ -388,6 +389,7 @@ func (u *UI) Register(m *http.ServeMux) {
 	u.integrationRoutes(m)
 	u.dreamRoutes(m)
 	u.studyRoutes(m)
+	u.privacyRoutes(m)
 
 	for _, p := range []struct{ path, title, note string }{} {
 		m.Handle("GET "+p.path, u.require(auth.RoleObserver, func(w http.ResponseWriter, r *http.Request) { u.render(w, r, "placeholder", p.title, p.note) }))