Docs for the three request guards (Core #268, Enterprise #72)

[fylorn]

Documentation for the unified request guards in ThinkWatchProject/ThinkWatch-Core#268 and ThinkWatchProject/ThinkWatch#72. Merge this only when those ship: Core in a release, Enterprise in a release, Lite in the version that bundles that Core.

What changes for readers:

• Three guards instead of five. Outbound redaction, tool-call inspection and the content filter. The output limit is gone (a routing rule that sets max_tokens caps answers; the upstream stops there itself) and hidden characters are content filter rules. Each guard has Off, Observe and a third mode named for what it does: Replace, Cut off, Enforce.
• Lite (docs-lite features and overview, /lite page): redaction searches the whole request, adds email and Chinese mobile number rules (off) and named placeholders (<<TW_PROJECT_1>>); the two new tool-call rules; content rules that refuse, delete or record, match by keyword, regex or code point, and the hidden-character rules; the Deleted mark on Traffic; max_tokens in Routing. The security feature on the Lite page is down to two sentences.
• Core (docs-core overview and crate layers, /core page): three guards with the content filter as its own item; tw-guard holds the rule model both products share; the redaction illustration shows <<TW_SECRET_1>>.
• Enterprise (overview, architecture, configuration, API reference, product page): the security.redact, security.inspect_tools and security.content settings, their shape (that of Core's security section), permissions and the conversion of the old keys; a model's maximum output tokens; the product page's guard bullet replaces "Content filtering & PII redaction".
• Core documents snapshot (src/data/core-docs) synced from Core's feat/guard-unify with CORE_DOCS_REF=feat/guard-unify pnpm core-docs, so the build warns that it differs from the current release (v0.57.1). Before merging, run pnpm core-docs once the Core release is out, so the snapshot is pinned to its tag.

Not changed: screenshots and their alt text (they still show the five-guard UI until the next shoot), and the historical changelog entries.

pnpm build passes locally.

🤖 Generated with Claude Code