p2.5: redact reason/err for permit_restricted logs

Guard messages embed the hostname (resolve <host>, no addresses for
<host>). Restricted callers now log a coarse reason class and err=-.
Test dumps slog records and forbids the hostname anywhere in them.

docs: P3 review — fail-closed search, cache class, public dialer

docs/P2.md

@@ -150,7 +150,9 @@ context calls/hits/failures; recover attempts/successes by route; token ratio hi
 Logs: one INFO line per request with `caller host mode q_len raw_tokens returned_tokens
 digest_ms fallback`. Never log page content, questions longer than 80 chars, or keys.
 Callers in `context.permit_restricted` log `host=-` on scrape, fetch, refused, fetch-failed,
-and internal lines (P2.5). `final_url` stays in the response body.
+and internal lines (P2.5). Their `reason` is a coarse class (`blocked`, `timeout`, …) and
+`err` is `-`, so guard messages like `blocked: resolve <hostname>` do not reach the journal.
+`final_url` stays in the response body.
 
 ## 7. Tests