feat(maintenance): one-shot PII redaction tool for pre-DC-095 log files (DC-098) [glm-grade=A]

- scripts/redact-log-pii.js: atomic in-place email redaction reusing the
  canonical DC-095 masker (no second regex), dry-run/keep-raw modes,
  dir walk with skip-set, post-verify (exit 2 if raw addresses remain).
- src/utils/logging.js: export EMAIL_RE/maskEmailAddress/maskEmailsInString
  (additive; no logger behavior change).
- __tests__/redact-log-pii.test.js: 11 tests (shape, idempotence,
  clean-untouched, dry-run, keep-raw, skip-set, passthroughs, exit codes).
- Judge: GLM-5.3 cold read, round-1 A/ship (deleg_4e684a18), URN
  urn:ump:7y2q5upoht7xq2mhlum764y2h36qpsgufyqsgx4cbijfpmfpmrcq.
- Suite: 120/120 suites, 2751 tests green.

dashcaddy-api/src/utils/logging.js

@@ -607,4 +607,12 @@ module.exports = {
   AUDIT_SKIP_PATHS,
   AUDIT_ACTION_MAP,
   SENSITIVE_KEYS,
+  // Email-PII masking primitives — exported for maintenance tooling
+  // (scripts/redact-log-pii.js rewrites pre-DC-095 log files with the SAME
+  // canonical mask so historical and new lines show one consistent shape).
+  // EMAIL_RE is a /g regex: always clone it (new RegExp(src, flags)) before
+  // .test()/.exec() or you will inherit a stale lastIndex.
+  EMAIL_RE,
+  maskEmailAddress,
+  maskEmailsInString,
 };