Security and privacy

Status reports should expose enough evidence for users/operators without leaking keys, JWT/bearer credentials, push tokens, private messages, private Identity data or confidential provider payloads. Never weaken safety constraints merely to restore a green dashboard.