fix: redact IVR menu choice logs

[Justinabox]

Summary

• Redact valid IVR menu-selection INFO logs so they never include the selected DTMF value or application-supplied option description.
• Redact invalid menu-choice DEBUG logs while retaining accepted/invalid operational signals.
• Add focused caplog regressions that prove routing and handler behavior remain intact and synthetic sensitive values never enter logs.

Issue

Closes #61 (narrow IVR logging slice; does not overlap the separate DTMF collector work in #238).

Verification

• git diff --check
• PYTHONPATH=. uv run --no-project --with pytest --with pytest-asyncio --with pyserial-asyncio pytest tests/test_ivr.py -q → 16 passed
• PYTHONPATH=. uv run --no-project --with pytest --with pytest-asyncio --with pytest-aiohttp --with pyserial-asyncio --with aiosqlite pytest tests/ -q → 993 passed

Risk

Low: this changes only log payloads. IVR routing, return values, handler invocation, retry behavior, and audio prompts are unchanged. No hardware or external backend access was used.

[Justinabox]

Release-gate evidence: reviewed the IVR logging-only privacy change and its runtime caplog coverage. I merge-tested this PR head with current origin/main after #254; git diff --check passed and the required local gate passed: PYTHONPATH=. uv run --no-project --with pytest --with pytest-asyncio --with pytest-aiohttp --with pyserial-asyncio --with aiosqlite pytest tests/ -q → 997 passed. No GitHub check runs are configured. Classified safe-to-land; proceeding with squash merge.