fix(security): close critical findings #1-3 from issue #17

- TLS: validate cert chain by default; debug-menu toggle to disable
  - Logs: redact secrets in sender/dispatcher payloads
  - Identity: per-install mt_instanceid/deviceId, per-launch clientSessionId

lib/core/utils/log_redact.dart

@@ -0,0 +1,39 @@
+const _redacted = '***';
+
+const _sensitiveSubstrings = ['password', 'token', 'phone', 'secret'];
+
+const _sensitiveExact = {
+  'code',
+  'verifycode',
+  'smscode',
+  'otp',
+  'hint',
+  'pin',
+  'qrlink',
+  'text',
+  'msisdn',
+};
+
+bool _isSensitiveKey(Object? key) {
+  if (key is! String) return false;
+  final k = key.toLowerCase();
+  if (_sensitiveExact.contains(k)) return true;
+  for (final s in _sensitiveSubstrings) {
+    if (k.contains(s)) return true;
+  }
+  return false;
+}
+
+dynamic redactForLog(dynamic value) {
+  if (value is Map) {
+    final out = {};
+    value.forEach((k, v) {
+      out[k] = _isSensitiveKey(k) ? _redacted : redactForLog(v);
+    });
+    return out;
+  }
+  if (value is List) {
+    return value.map(redactForLog).toList();
+  }
+  return value;
+}