p2.5: redact reason/err for permit_restricted logs

Guard messages embed the hostname (resolve <host>, no addresses for
<host>). Restricted callers now log a coarse reason class and err=-.
Test dumps slog records and forbids the hostname anywhere in them.

docs: P3 review — fail-closed search, cache class, public dialer

internal/api/api.go

@@ -501,14 +501,14 @@ func (s *Server) writeFetchErr(w http.ResponseWriter, c *auth.Caller, rawURL str
 			fe.Msg = "internal error"
 		}
 		if fe.Status == 401 || fe.Status == 403 {
-			s.Log.Warn("refused", "caller", name, "host", host, "reason", fe.Msg)
+			s.Log.Warn("refused", "caller", name, "host", host, "reason", s.logReason(c, fe))
 		} else {
-			s.Log.Warn("fetch failed", "caller", name, "host", host, "reason", fe.Msg, "status", fe.Status)
+			s.Log.Warn("fetch failed", "caller", name, "host", host, "reason", s.logReason(c, fe), "status", fe.Status)
 		}
 		writeErr(w, fe.Status, fe.Msg, fe.Hint)
 		return
 	}
-	s.Log.Error("internal", "caller", name, "host", host, "err", err)
+	s.Log.Error("internal", "caller", name, "host", host, "err", s.logErr(c, err))
 	writeErr(w, 500, "internal error", "")
 }
 
@@ -591,6 +591,56 @@ func (s *Server) logHost(c *auth.Caller, raw string) string {
 	return hostOf(raw)
 }
 
+func (s *Server) restrictedLog(c *auth.Caller) bool {
+	return c != nil && permittedCaller(c.Name, s.PermitRestricted)
+}
+
+// logReason is the reason field for fetch error logs. Restricted callers get a
+// coarse class so the hostname in guard messages does not land in the journal.
+func (s *Server) logReason(c *auth.Caller, fe *fetch.Error) string {
+	if fe == nil {
+		return "-"
+	}
+	if s.restrictedLog(c) {
+		return coarseReason(fe)
+	}
+	return fe.Msg
+}
+
+func (s *Server) logErr(c *auth.Caller, err error) any {
+	if s.restrictedLog(c) {
+		return "-"
+	}
+	return err
+}
+
+func coarseReason(fe *fetch.Error) string {
+	switch fe.Status {
+	case 401:
+		return "unauthorized"
+	case 403:
+		return "blocked"
+	case 400:
+		return "bad request"
+	case 413:
+		return "too large"
+	case 415:
+		return "unsupported"
+	case 429:
+		return "busy"
+	case 504:
+		return "timeout"
+	default:
+		if fe.Status >= 400 && fe.Status < 500 {
+			return "upstream 4xx"
+		}
+		if fe.Status >= 500 {
+			return "upstream 5xx"
+		}
+		return "-"
+	}
+}
+
 func writeErr(w http.ResponseWriter, status int, msg, hint string) {
 	if status == 502 {
 		status = 500