feat(privacy): MONITOR_PRIVACY_REDACT — opt-in ingest-time secret redaction

.env.example

@@ -58,3 +58,32 @@
 # fs.watch watcher fires near-instantly regardless; this poll is the safety net.
 # Set to 0 to disable the poll while leaving the watcher running (default: 30000).
 #   DASHBOARD_SESSION_SYNC_MS=30000
+
+# ── Ingest filters ────────────────────────────────────────────────────────────
+# Comma-separated list of working-directory patterns whose hook events should be
+# silently discarded before they are written to the database. Useful when you
+# run Claude Code in private or scratch directories you never want to appear in
+# the dashboard, analytics, or exports.
+#
+# Supported pattern forms (forward slashes, case-sensitive):
+#   /home/user/private         exact match
+#   /home/user/work/*          direct children only (no deeper nesting)
+#   /home/user/work/**         /work and all descendants
+#
+# The hook handler responds 200 so Claude Code does not retry — the event is
+# intentionally dropped rather than errored. Sessions whose first hook is ignored
+# are never created, so they will not appear in the sessions list at all. For
+# sessions already in the database (created before the filter was added), see the
+# DELETE /api/sessions/:id endpoint.
+#
+#   MONITOR_IGNORE_CWD=/home/user/private,/home/user/scratch/**
+
+
+# ── Privacy / redaction ───────────────────────────────────────────────────────
+# When set to "true", hook event payloads are scanned for secret-like values
+# (API keys, tokens, private-key blocks, bearer tokens, URL credentials, AWS
+# access keys) and matching strings are replaced with [REDACTED] BEFORE the
+# event is written to SQLite or broadcast over WebSocket.
+# Structural routing fields (session_id, cwd) are never redacted.
+#
+#   MONITOR_PRIVACY_REDACT=true