Redacted diagnostics bundle for support cases

make support-bundle collects a single redacted tarball containing the artefacts most often requested during a support case: recent container logs, version manifests, the output of the health endpoints, the current migration state, and the resolved configuration mode for each component.

Secrets are scrubbed before the archive is written. The scrubber strips known credential fields from configuration, masks bearer tokens and API keys from log lines, and replaces database connection strings with redacted forms. The bundle is written under the host’s working directory; nothing is uploaded.

No action required. The command is opt-in and runs against the live install without restarting any container.