feat: add privacy-safe diagnostic journal

[kev1n77]

Summary

• persist runtime diagnostics as timestamped, validated event codes without error details
• bound the private JSONL journal to 256 KiB and include only the latest 100 events in reviewed support bundles
• add end-to-end canary coverage across SQLCipher DB/WAL, journal, temporary files, and support output
• update security, threat-model, and progress documentation for SEC-001 and REL-002

Verification

• cargo fmt --all -- --check
• cargo test --workspace --all-targets
• cargo clippy --workspace --all-targets -- -D warnings
• cargo fmt --manifest-path apps/desktop/src-tauri/Cargo.toml -- --check
• cargo test --manifest-path apps/desktop/src-tauri/Cargo.toml --all-targets
• cargo clippy --manifest-path apps/desktop/src-tauri/Cargo.toml --all-targets -- -D warnings
• npm run desktop:check
• npm run desktop:build
• python -m unittest discover -s sidecars/mitmproxy/tests -v