- randomHex: panic on crypto/rand failure instead of silently producing
  zero-byte keys
- public.go: mask email in server log (was plaintext PII, now uses
  maskEmail consistent with the wire response)
- redeem.go removeFirstLine: strip trailing \r from Windows-edited files
  so rewrite cycles don't accumulate stray carriage returns
- admin.go handleKeys POST: reject token if it collides with an existing
  donor key (prevents accidental namespace overlap)
- Remove dead code: redactYAMLKeys + redactListAt (unused since v0.9.1
  switched getConfig to return raw keys)