perf(security): optimize PiiMasker with zero-allocation word token scanner and reverse digit extractor #1516

Summary

In lib/core/security/pii_masker.dart (lines 20–32, 66–87):

1. Column Name Tokenization:
   _tokens(String name) converts column names into tokens using multiple string transformations:

   name.replaceAllMapped(RegExp(r'([a-z0-9])([A-Z])'), ...)
       .replaceAll(RegExp(r'[^A-Za-z0-9]+'), ' ')
       .toLowerCase()
       .split(' ')

   This is executed for every column in every executed query.
2. Cell Value Masking:
   In maskPiiValue(PiiKind kind, String value), phone and card numbers are masked via:

   final digits = value.replaceAll(RegExp(r'\D'), '');
   return '•••• •••• •••• ${digits.substring(digits.length - 4)}';

   This regex replaces and allocates a new String on every rendered cell of the data grid.

Architectural Solution: Zero-Allocation Micro-Functions

1. static void _scanWordTokens(String name, void Function(int start, int end) onToken)
   • Scans camelCase boundaries and non-alphanumeric separators by index using codeUnitAt.
   • Compares word spans against known sensitive token sets without intermediate list or substring allocations.
2. static String _maskTrailingDigits(String value, int visibleCount, String prefix)
   • Scans backwards from value.length - 1 counting ASCII digit code units (0x30..0x39).
   • Appends the last visibleCount digits to a buffer without allocating a clean digits string.

Acceptance Criteria

• PII column detection performs zero regex replacements and zero split(' ') list allocations.
• PII cell masking on large tables does not drop frames below 120 Hz during fast vertical scrolling.
• Tests in test/core/security/pii_masker_test.dart pass with 100% parity.