feat(smart-rma): add local redaction - #13

Summary

• complete P3-003 with browser-only redaction for serial numbers, WWNs, host names, domains, IPv4/IPv6, email, and common Secret labels
• cover smartctl variants such as Device Serial No., SerialNumber, LU WWN Device Id, and host names containing underscores
• add the versioned smart-rma-boundary-projection-v1 allowlist for future AI and export consumers
• keep URL, log, and Analytics projections limited to stable metadata
• add an inspectable local redaction preview and count-only privacy report to /smart-rma/
• update the Lab contract, docs, static production checks, and TODO; recommend P3-004 next

Privacy and cost

• raw input remains in current-page memory only
• changing the input clears stale parse and redaction results
• raw or redacted text never enters URL, logs, Analytics, AI requests, or export payloads
• AI/export projections contain only enums, numbers, known ATA IDs, stable signals, and redaction counts
• unknown vendor attribute names and values are omitted from the cross-boundary projection
• no network, storage, logging, Analytics receiver, AI call, or runtime AI cost is added

Validation

• npm run validate
• Astro/TypeScript: 0 errors, warnings, or hints
• Vitest: 20 files and 229 tests passed
• static build: 5 pages, including /smart-rma/
• all static output contracts passed
• remote Git tree matches local HEAD exactly

Deliberate limits

• pattern matching cannot prove that every unlabelled random identifier is safe; the no-raw-text boundary and explicit allowlist remain the primary protection
• P3-004 still owns deterministic health classification
• P3-005/P3-006 still own AI explanation and user-triggered exports
• this task does not make a vendor warranty/RMA decision

Next

Implement P3-004 as a separate PR with evidence-linked healthy/warning/critical/unknown rules, explicit conflict handling, and no AI dependency.