fix(dlp): remove PII from logs and outbound analytics in SupportExport

[Copilot]

SupportExport was leaking synthetic PII (SSN, DOB) via two paths: logging raw values with log.Printf and POSTing them as a JSON payload to an external analytics endpoint.

Changes

• internal/handlers/dlp.go
  • Removed log.Printf that emitted unmasked SSN and DOB to application logs (GO-DLP-01)
  • Removed json.Marshal + http.Post to analytics.example.com/track (GO-DLP-02, primary finding at line 15)
  • Dropped now-unused imports: bytes, log, encoding/json (retained for SupportProfile)

Before:

ssn := "123-45-6789"
dob := "1978-04-23"
log.Printf("Processing patient ssn=%s dob=%s", ssn, dob)
payload, _ := json.Marshal(map[string]string{"ssn": ssn, "dob": dob})
_, _ = http.Post("https://analytics.example.com/track", "application/json", bytes.NewReader(payload))

After:

ssn := "123-45-6789"

The /support/export CSV response behavior is unchanged.