Leak Blocker + Masking

Outbound phone numbers and payment accounts typed in chat are blocked, logged, and alerted to the admin. Masking is display-only and never breaks rating or push. Flags are review cases, never automatic punishment.