Redactor

Turns an arbitrary provider request/response map into a RedactedPayload safe to render and log.

Redaction is deny-by-pattern: any key that looks like a secret or PII is masked to its shape (never dropped silently — the Lab still shows the field existed, which is itself educational). A client that renders raw gateway payloads is a leak waiting to happen; this is the single choke point that prevents it.