fix: keep bootstrap logs and native trace labels metadata-only

[OskarEichler]

Fixes

• Remove token/header/body/form values and request URLs from automatic Fetch/WebSocket bootstrap logs.
• Remove HTTP paths, WebSocket URLs and arbitrary WebSocket error strings from opt-in native trace labels, preserving timing/status/byte-count instrumentation.
• Document the intentional sensitive-data boundary of explicitly enabled NetworkInspector and attached DevTools.

Compatibility / breaking changes

• Logs/traces no longer identify requests by URL/path or print credentials. HTTP method, status, counts and timing remain.
• Normal logging is enabled in debug builds; release logging/tracing require explicit opt-in. This is not a claim that default release builds exposed these values.
• NetworkInspector and attached DevTools intentionally retain their diagnostic capture behavior and require care when exporting.

Verification

• Synthetic canary execution across all automatic Swift/Kotlin/ObjC bootstrap log expressions changes baseline leakage to no leakage; no real credentials were used.
• Android/iOS example builds pass with native tracing explicitly enabled. Fresh investigator/reviewer examined shared logging callers and bypass paths.
• No claim of a full device log-capture test or of redaction in the deliberately enabled inspectors.

Fixes #199. Fixes #205.

Changes were reviewed against upstream 627c77e. No test/spec files were added or modified. Release/version selection is left to the maintainers.

Consumer verification

All nine independent PR source overlays pass TypeScript. The combined fixes were backported to the existing 1.6.1 package without upgrading its dependency constraints. Both Android/iOS app variants, four production Metro bundles, 13 web builds, four extension builds and app lint pass. The installed artifact is immutable and its 269 non-metadata files match the build-verified candidate.

[vercel]

@OskarEichler is attempting to deploy a commit to the Margelo Team on Vercel.

A member of the Team first needs to authorize it.