v1.34.4 — Privacy: logs and alerts never carry query inputs

Patch release on v1.34.3 — no API surface change (54 MCP tools, 7 Resources, 3 Prompts unchanged).

Privacy hardening

• The request-path log sanitizer now covers every path-param route (scan, redirect, robots, brand, seo, audit, email/verify, email/security-posture, threat-report, kev, atlas, d3fend, sigma, cwe) — logged paths show a redacted placeholder instead of the queried value, matching the documented privacy contract (privacy.html).
• Fetch-failure and scanner log lines record only the coarse exception kind — the queried target and full exception text no longer appear in log output.
• The per-target throttle alert masks the target; the disclosed per-target counter remains the operator's lookup source.

Tests

• 2591 → 2599 pytest (sanitizer coverage, alert masking, and log-content regression assertions that fail if a target or exception message reappears in log output).

No schema or cache migration; fully wire-compatible.