[P2] Opt-in console/network capture + PII masking + consent

[thorwhalen]

Richer capture behind an explicit opt-in; privacy designed in.

• console ring buffer (wrap console.*, window.onerror, unhandledrejection)
• network ring buffer (wrap fetch/XHR; clone responses) + PerformanceObserver metadata
• PII masking ON by default (mask text/inputs/media; invert rrweb's permissive defaults)
• Consent affordance gating heavy capture (ePrivacy Art. 5(3)); default-minimal needs no prompt
• redact-before-capture — never let unmasked PII reach the wire

Design: design.md (Capture & privacy) · #1