Add scoped Todos evidence redaction

[andrei-hasna]

Summary

• Add todos redaction evidence for task/comment-scoped evidence scans and redaction without printing secret values.
• Require explicit --authority plus --confirm REDACT_TODOS_EVIDENCE before apply, and create an integrity-checked SQLite backup first.
• Extend local redaction detection for npm and GitHub token families and add regression coverage for redacted placeholders.

Validation

• bun test src/lib/evidence-redaction.test.ts src/lib/redaction.test.ts
• bun test src/cli/cli.test.ts -t "should manage local secret redaction from the CLI"
• bun run typecheck
• bun run build
• Live scoped dry-run on the report ids: rows_scanned=21, matched_fields=3, findings=5, redacted_preview.clean=true, applied_fields=0.
• No-authority apply refusal: exit=1, backup=null, no rows scanned.
• Project-scoped bridge export and backup bundle scans: ok=true, findings=0.
• Staged/commit patch redaction scan: ok=true, findings=0.

Operational Note

No live Todos rows were mutated. Applying live redaction remains gated on explicit authority and the confirmation token above.