feat: DLP integration — Presidio and Google Cloud DLP for PII detection

[nfvelten]

Migrated from nfvelten/arbitus#120

Summary

Arbitus has regex-based payload filtering but no integration with dedicated DLP engines. Enterprise deployments need structured PII detection (credit cards, SSNs, emails, etc.) that goes beyond regex patterns.

Proposed integrations

rules:
  dlp:
    - type: presidio
      url: "http://presidio:5001"
      entities: [CREDIT_CARD, SSN, EMAIL_ADDRESS, PHONE_NUMBER]
      action: redact   # or block
    - type: google_dlp
      project: "my-gcp-project"
      action: block

Implementation approach

• DlpBackend trait with analyze(text) -> Vec<Finding>
• Presidio integration via REST API (open source, Microsoft, 3.4k stars)
• Google Cloud DLP via gRPC client
• Results feed into existing PayloadFilterMiddleware decision flow

Prerequisites

Depends on WASM plugin system (ROADMAP_SECURITY.md §2.5) for custom DLP engines — built-in integrations can ship independently.

References

• PROPOSAL.md §2.5