DOM-capture recorder: redact secrets and PII at capture time

[rosscado]

Problem: recorded DOM fixtures (scripts/dom-capture/recorder.js output and manual captures under doc/dom/) have historically embedded live session tokens, emails, and account/org/device ids verbatim — PR #541 had to scrub three ChatGPT fixtures after the fact, and the #547 secret-scan baseline needed a rule-scoped allowlist for that directory.

Scope: the capture path (recorder + any documented manual capture recipe). Out of scope: the already-scrubbed historical fixtures, the CI scan itself (#531).

Reproduction / verification: capture any authenticated host page today → tokens/emails/user-org-device ids land in the artifact verbatim. Verify done = a fresh capture of an authenticated page contains only redacted placeholders (fake alg:none JWTs, redacted@example.com, user-REDACTED etc.), and the doc/dom capture recipe documents the guarantee.

Acceptance criteria:

• Capture-time redaction covers: JWT-shaped strings, email addresses, user-/org- account ids, device UUIDs (the classes found in the chore(hygiene): untrack local tunnel config; scrub tokens from recorded fixtures #541 scrub).
• The redaction is on by default; opting out requires an explicit flag documented as never-commit.
• The safety: secret scanning in CI — gitleaks with clean baseline (#531) #547 .gitleaks.toml fixture allowlist entry can be narrowed or removed once fixtures are guaranteed clean at capture.

Notes (non-binding): flagged by the #541 review and #547 review (nit 1) — this issue makes the follow-up tracked rather than a doc paragraph.