Add coverage-gap detection: ignored-hrefs registry, Repairs issue, redaction

Implements the first half of the device-capability-diagnostics spec:

- registry/capabilities/ignored.py: known-noise hrefs (Bixby/voice
  provisioning, WiFi/BLE info, OTA/region housekeeping, and a couple of
  redundant hrefs) declared as no-entity Capability objects, so
  discover()'s existing unknown-resource reporting treats them as covered
  instead of flagging every device as having gaps. Folded into each
  by_type registry and into the global fallback CAPABILITIES set.
- discovery.py: log() callback now passes the raw href instead of a
  formatted message, so callers can collect a clean unbound-hrefs list.
- coordinator.py: wires that callback into self._unbound_hrefs, tracks
  device_type_name/one_ui_version, and raises (or clears) a Repairs issue
  when a device's type is unrecognized or it has genuinely unmodeled
  hrefs left over.
- registry/redact.py: recursive, substring-keyed redaction for anything
  that looks like account/identity data, ahead of the diagnostics.py
  platform that will consume it.

Verified against the real dishwasher/refrigerator fixtures: known-noise
hrefs no longer show up as gaps, while genuine gaps (e.g. /bespoke/vs/0
on the fridge) still do.

tests/test_redact.py

@@ -0,0 +1,74 @@
+"""Tests for registry.redact — the safety net for diagnostics downloads."""
+import json
+from pathlib import Path
+
+from custom_components.localthings.registry.batch import parse_device0_batch
+from custom_components.localthings.registry.redact import REDACTED, redact_resources
+
+FIXTURES = Path(__file__).resolve().parent / 'fixtures'
+
+
+def _load(name: str) -> dict:
+    data = json.loads((FIXTURES / name).read_text())
+    return parse_device0_batch(data['device0'])
+
+
+def test_redacts_known_sensitive_fields_in_dishwasher_dump():
+    resources = _load('dishwasher_device.json')
+    redacted = redact_resources(resources)
+
+    info = redacted['/information/vs/0']
+    assert info['x.com.samsung.da.serialNum'] == REDACTED
+    assert info['x.com.samsung.da.otnDUID'] == REDACTED
+
+    wireless = redacted['/wirelessinfo/vs/0']
+    assert wireless['macaddressWiFi'] == REDACTED
+    assert wireless['macaddressBLE'] == REDACTED
+
+    provisioning = redacted['/voice/provisioning/vs/0']
+    headers = provisioning['voice.provisioning.headers']
+    assert headers['login_id'] == REDACTED
+    deviceinfo = provisioning['voice.provisioning.deviceinfo']
+    assert deviceinfo['voice.provisioning.deviceinfo.accesstoken'] == REDACTED
+    assert deviceinfo['voice.provisioning.deviceinfo.deviceid'] == REDACTED
+    assert deviceinfo['voice.provisioning.deviceinfo.userid'] == REDACTED
+
+
+def test_ordinary_state_fields_survive_untouched():
+    resources = _load('dishwasher_device.json')
+    redacted = redact_resources(resources)
+
+    op_state = redacted['/operational/state/vs/0']
+    assert op_state['x.com.samsung.da.state'] == 'Run'
+    assert op_state['x.com.samsung.da.progress'] == 'Finish'
+
+    power = redacted['/power/vs/0']
+    assert power['x.com.samsung.da.power'] == 'On'
+
+    dishwasher = redacted['/dishwasher/vs/0']
+    assert dishwasher['x.com.samsung.da.sanitize'] == 'On'
+    assert dishwasher['x.com.samsung.da.rinseLevel'] == '4'
+
+    alarms = redacted['/alarms/vs/0']['x.com.samsung.da.items']
+    assert alarms[0]['x.com.samsung.da.code'] == 'SNSF_Reached'
+
+
+def test_redacts_known_sensitive_fields_in_refrigerator_dump():
+    resources = _load('refrigerator_device.json')
+    redacted = redact_resources(resources)
+
+    info = redacted['/information/vs/0']
+    assert info['x.com.samsung.da.serialNum'] == REDACTED
+
+    wireless = redacted['/wirelessinfo/vs/0']
+    assert wireless['macaddressWiFi'] == REDACTED
+    assert wireless['macaddressBLE'] == REDACTED
+
+
+def test_redact_resources_does_not_mutate_input():
+    resources = _load('dishwasher_device.json')
+    original_serial = resources['/information/vs/0']['x.com.samsung.da.serialNum']
+
+    redact_resources(resources)
+
+    assert resources['/information/vs/0']['x.com.samsung.da.serialNum'] == original_serial