add the offline reflection engine and the privacy strip rule

[vyagh]

Two commits:

1. reflection.py: the offline reflection engine: Jo's question banks, session storage, and the acceptance bar for turns.
2. model.strip_private: reflections, next_steps and moment snaps are cleared on writes to external volumes. In-place rewrites on the entry's own volume keep them (_rewrites_entry_in_place, eight tests); backups keep everything.

Independent of the view PRs; stacked on #1111 for ordering only.

• Jo's only memory: the opener may echo the entry title (child-typed) or the newest caption. Once, never mid-conversation.
• sugar-datastore PR (keep snaps and reflections out of the search index sugar-datastore#30) should land first, or reflection words
  become searchable in the Journal.
• request_turn's title/description/next_steps are unread offline: the seam for a later server layer.
• The category table and turn_acceptable overlap sugar-ai deliberately: zero third-party deps offline, and gettext strings reach translators.

221 journal tests (101 engine, 8 privacy); discovery needs the stack's tests/journal/init.py.
New files in Makefile.am and POTFILES.in.
Series notes in #1111.