feat(ledger): PHI-redaction pass on Task.body + LogEntry, and ingestion body validator

## Context
Ledger holds task bodies for Portico (a HIPAA product). Two related gaps:
1. No PHI-redaction sweep on `Task.body` / `LogEntry` — a Portico ticket could inadvertently include patient identifiers pasted from Slack/logs.
2. No body validator on POST/PATCH — malformed bodies (missing Context/AC sections) reach the queue.

## Acceptance Criteria
- [ ] Regex-based redactor for common PHI patterns (SSN, phone, DOB, MRN-like IDs, "Patient <Name>", "Client <Name>", email in body)
- [ ] Runs on every POST/PATCH before insert, replacing matches with `[REDACTED-<kind>]`
- [ ] Emits warning to `LogEntry` when redactions applied
- [ ] Body-shape validator: reject if body doesn't contain `## Context` and `## Acceptance Criteria` sections (with a bypass flag for internal tooling)
- [ ] CI test: fixture bodies containing PHI → verify redaction
- [ ] Backfill dry-run script that reports redactions needed on existing 314 tasks (do not apply yet)

## Files Touched
- operant-studio/apps/web/src/lib/phi-redactor.ts (new)
- operant-studio/apps/web/src/lib/body-validator.ts (new)
- operant-studio/apps/web/src/app/api/studio/[team]/tasks/route.ts
- operant-studio/scripts/backfill-phi-scan.ts (new)

## Dependencies
- None

## Verification
- Fixture-based unit tests pass
- Backfill script report reviewed before running mutations