Privacy: PII-scrub error payloads; stop logging raw IP+UA per hit; align docs with code defaults

collect.ts logs raw IP+UA on every hit (streams PII to CloudWatch indefinitely) while docs promise inputs are discarded. Error ingest stores body.user and 20 breadcrumbs verbatim with zero scrubbing. docs/features/privacy.md claims full anonymization default; code default is partial. Fix: delete the log line; PII-scrub module (emails/JWTs/bearer tokens/query strings) for error ingest; log retention in deploy templates; docs truth pass.

From the production-readiness audit (docs/research/production-readiness.md, eacf996). Verified with live probes where stated.

Re-scoped: (1) the raw IP+UA per-hit log was removed in 811c51c; (2) PII-scrubbing for error payloads moves to the standalone error-tracking product (error ingest was extracted from ts-analytics in 28a3a02 — see the pre-xray-split tag); (3) remaining here: align docs/features/privacy.md with actual defaults (code default is 'partial' anonymization) and add log-retention to deploy templates.