…en write surface

The MCP `mem_add` path enforces a secret-class redaction guard before any
filesystem write, but the surrounding ingress paths (Web `POST /api/add`,
`POST /api/upload`, `PATCH /api/chunks/{id}`, scratch promotion, MCP
`mem_edit`, CLI `mm add` / shell `add` / agent share, LangGraph adapter)
were writing `req.content` / `new_content` / `entry["value"]` directly.
The same SQLite database could end up holding cleartext provider tokens
depending on which route the agent or user came in through.

Centralise the scan-decide-log shape in
`privacy.enforce_write_guard(content, surface=…, force_unsafe=False,
audit_context=…)` returning a `WriteGuardResult` (`pass` /
`blocked` / `bypassed`) and apply it at every gap surface. Each surface
records under its own `by_tool` key so attribution stays observable;
audit-log lines render `audit_context` as `key=value` pairs after
`surface=` and never echo matched bytes. Web mutating routes return
HTTP 403 with `{detail: "redaction_blocked", hits: N, surface: …}` so
the SPA can surface a confirm-and-retry UX before re-sending with
`force_unsafe=true`.

`mem_batch_add` keeps its inline scan + per-entry counter pattern —
the helper's single-content shape would obscure the transactional
"one hit rejects the whole batch" rule that test_memory_crud_redaction
already pins.

Out of scope (follow-up):
- `indexing/importers.py` and `indexing/url_fetcher.py` write external
  file/URL content rather than user-driven content; the trust model is
  different (operator-authorised indexing, not direct user submission)
  and merits its own decision pass.

Tests:
- `test_privacy.py::TestEnforceWriteGuard` — helper contract
  (pass / blocked / bypassed-with-audit / clean+force-unsafe still
  records pass / matched bytes never reach the log).
- `test_redaction_write_surfaces.py` — `mem_edit`, CLI `mm add`, and
  the LangGraph adapter all run the guard and route the counter to
  the right `by_tool` key.
- `test_web_routes.py` — new `TestAddMemoryRedaction`,
  `TestEditChunkRedaction`, `TestUploadRedaction`,
  `TestScratchPromoteRedaction` cover all four web mutating routes
  (block / bypass / clean-pass) end-to-end via ASGI client.

Existing 36-test redaction floor + 4048-test full suite stay green;
ruff check + format clean.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

…itizer

Codex re-review of #784 showed the audit-context sanitizer landed
in cd27c99 only covered ``enforce_write_guard``'s single-content
path. ``mem_batch_add`` keeps its own transactional decision shape
and its own ``logger.warning`` line (``memory_crud.py:472``), so a
secret-shaped ``file=`` argument still leaked verbatim into the
warning log on a bypass — exactly the leak class cd27c99 was meant
to close.

Extract the audit emit into a public ``privacy.emit_bypass_audit``
seam:

- Same line shape as before
  (``redaction bypass via force_unsafe=True (surface=…, …,
  content_chars=…, hits=…)``).
- Each ``audit_context`` value runs through ``_sanitize_audit_value``
  before ``%r`` formatting, so a secret embedded in a user-controlled
  string field (``namespace`` / ``file`` / ``filename`` / ``key`` /
  ``chunk_id``) gets replaced with ``<redacted: secret-shape>``
  regardless of which entry point logged it.
- Counter (``record(...)``) is intentionally NOT bumped by the
  emitter; ``mem_batch_add`` still owns its per-item bookkeeping
  contract that ``test_memory_crud_redaction.py`` already pins.

``enforce_write_guard`` now delegates to ``emit_bypass_audit``, and
``mem_batch_add`` calls it directly with the same audit_context
shape (``namespace`` / ``file`` / ``item_idx``).

New regression
``TestMemBatchAddRedactionGuard.test_secret_shaped_file_argument_is_redacted_in_audit_log``
reproduces Codex's manual repro: feed a secret-matching value plus a
``file=…sk-…`` filename into a force_unsafe batch and assert the
warning line never contains the matched-bytes prefix while still
carrying the redaction marker.

Stale-comment Minor (``app.js:3730`` / ``:3763``) lands separately as
#786 on main; out of scope here.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>