fix(gateway): bound redaction token preprocessing

[dmoliveira]

Summary

• Reject oversized redaction tokens before trim, byte-length, or detector preprocessing.
• Preserve invalid oversized configuration values for fail-closed shared validation instead of silently falling back.
• Add direct ordering regression coverage and regenerate gateway output.

Validation Evidence

• npm test (967 passing)
• npm run lint
• make validate
• pre-commit run --all-files
• git diff --check
• Final static security review: no blocker findings.