Opt-in session trace and recording export

[AetherAI3]

Goal

Add an opt-in, bounded session trace/recording export suitable for debugging and reproducible
release evidence.

Scope

• Define a versioned event schema for session lifecycle, navigation, interaction, and snapshot
  metadata.
• Make content capture, screenshots, and video separate explicit opt-ins.
• Apply deterministic size, duration, event-count, and retention bounds.
• Redact authorization headers, tokens, credentials, form secrets, and configured sensitive fields.
• Record integrity metadata so an exported trace can be tied to an exact commit and image.
• Provide safe deletion and failed-export cleanup behavior.

Acceptance criteria

• Recording is disabled by default and cannot widen browser authority or egress.
• Tests prove secrets never appear in default exports and bounds fail closed.
• Redirects, errors, and partial sessions produce well-formed terminal records.
• Documentation distinguishes diagnostic traces from runtime/demo proof.
• A threat-model update covers local disclosure, retention, and multi-user risks.
• Exact-image staging acceptance verifies export and cleanup behavior before release.