feat(clearance): add clearance smoke gate and session-safe integration

[ChechiDev]

Closes #145

Summary

• Adds a validation-only /api/clearance endpoint with auth and strict payload validation.
• Aligns the Chrome extension clearance payload with local-only runtime config and task-polling isolation.
• Adds logging redaction coverage and CLI smoke commands for safe dry-run/fake-local clearance gating.

PR Type

• Bug fix
• New feature
• Documentation only
• Code refactoring
• Maintenance/tooling
• Breaking change

Changes

File	Change
core/logging.py	Extends sensitive-key redaction for clearance/session-related fields.
infrastructure/work_server/server.py	Adds validation-only authenticated POST /api/clearance.
extensions/sportcrawl-chrome/background.js	Uses chrome.storage.local, emits backend-aligned clearance payload, and supports disable_task_polling.
cli/main.py	Registers smoke CLI commands, including smoke-clearance dry-run and fake-local --execute seam.
cli/smoke_player_info.py	Adds bounded player-info smoke helper used by CLI tests.
tests/unit/**	Adds unit/static contract coverage for logging, backend, extension, and CLI behavior.

Test Plan

• uv run pytest tests/unit/core/test_logging.py tests/unit/infrastructure/test_clearance_auth.py tests/unit/infrastructure/test_clearance_payload_validation.py tests/unit/infrastructure/test_extension_clearance_payload_contract.py tests/unit/infrastructure/test_extension_local_config_contract.py tests/unit/infrastructure/test_extension_clearance_smoke_mode_contract.py tests/unit/cli/test_smoke_clearance.py tests/unit/cli/test_smoke_clearance_execute_contract.py tests/unit/cli/test_smoke_player_info.py
• uv run ruff check core/logging.py infrastructure/work_server/server.py cli/main.py cli/smoke_player_info.py tests/unit/core/test_logging.py tests/unit/infrastructure/test_clearance_auth.py tests/unit/infrastructure/test_clearance_payload_validation.py tests/unit/infrastructure/test_extension_clearance_payload_contract.py tests/unit/infrastructure/test_extension_local_config_contract.py tests/unit/infrastructure/test_extension_clearance_smoke_mode_contract.py tests/unit/cli/test_smoke_clearance.py tests/unit/cli/test_smoke_clearance_execute_contract.py tests/unit/cli/test_smoke_player_info.py
• No browser/network/DB/Docker/work_server/real smoke commands were run.
• .doc/ roadmap files remain local-only and ignored.

Safety Notes

• smoke-clearance --execute is a fake/local seam only; it does not run real browser/network/work_server smoke.
• Real CP1.6 smoke remains blocked until explicit authorization.
• No raw token, cookie, clearance value, profile path, CDP, HTML, DSN, or secret output is introduced.
• /api/clearance is validation-only and does not persist clearance/session state.

Contributor Checklist

• Linked an approved issue
• Added exactly one type:* label
• Ran relevant tests/ruff
• Docs updated if behavior changed
• Conventional commit format
• No Co-Authored-By trailers