Add audited Conversations redaction tooling

[andrei-hasna]

Summary

• add conversations admin redact-messages for known message-id redaction
• keep dry-run as the default and require backup confirmation, dry-run confirmation, and owner authority before apply
• redact message content, metadata, attachment references, managed attachment files, FTS/export surfaces, and SQLite residual storage via secure delete, WAL truncation, and VACUUM

Verification

• bun test src/lib/admin-redaction.test.ts src/cli/commands/admin.test.ts
• bun run typecheck
• bun run build
• bun test
• gitleaks protect --staged --no-banner --redact
• gitleaks detect --source . --no-banner --redact --log-opts=origin/main..HEAD

Operational note

No live redaction or credential rotation was performed. Live mutation remains blocked until backup confirmation, reviewed dry-run approval, and owner rotation/redaction authority are present.