feat(review): document redaction — author in FreeEedUI, burn into ESI production, overlay in Viewer

[markkerzner]

Why

Redaction is a core eDiscovery capability FreeEed does not yet have. Reviewers must be able to black out privileged/PII/PHI content so it never reaches the produced set. We can produce (shmsoft/FreeEed#551) and review/view (shmsoft/FreeEed#550, shmsoft/FreeEed#553) but cannot redact — a hard blocker for real legal productions. An un-burned redaction is a malpractice-grade leak, so this must be implemented carefully.

Scope — spans 3 components

1. Authoring (FreeEedUI — primary, this repo): draw rectangular redaction boxes on the rendered page image; select text spans; assign a reason code (Privilege, PII, PHI, Confidential, …). Keyed by Bates + page.
2. Production burn-in (Implement standard eDiscovery (ESI) production format (TIFF + text + metadata + load files) FreeEed#551, lands in FreeEed core): on export, produced IMAGES (TIFF/PDF) render with opaque boxes; produced TEXT/OCR has redacted spans removed; redacted content excluded from the Lucene index; the unredacted native is withheld or replaced by the redacted rendering. May get a companion issue in shmsoft/FreeEed for the production-side work.
3. Viewer overlay + sync-back (FreeEed Viewer — portable packaged web app (viewer mode + notes round-trip) FreeEed#553): redactions are another writable overlay in review.sqlite (alongside notes/tags); a thumb-drive reviewer can redact and sync back; the Viewer must never render the original content under a redaction.

Storage

Non-destructive overlay — redactions stored as vector coordinates + reason, keyed by Bates; originals/natives untouched. Burn-in happens only at production time.

Acceptance

• Author image-box and text-span redactions in FreeEedUI, each with a reason code
• Redactions persist as a non-destructive overlay keyed by Bates
• Production burns redactions into images + text, excludes them from the index, and leaks no unredacted content (native/text/thumbnail) for a redacted doc
• Exportable redaction / privilege log (who / what / when / reason)
• Redactions can be authored in --viewer overlay and sync back (ties FreeEed Viewer — portable packaged web app (viewer mode + notes round-trip) FreeEed#553)

References

• Review UI: shmsoft/FreeEedUI (this repo)
• Production format: Implement standard eDiscovery (ESI) production format (TIFF + text + metadata + load files) FreeEed#551 — docs/specs/esi-production-format.md (burn-in target)
• Viewer MVP + overlay/sync-back: FreeEed Viewer — portable packaged web app (viewer mode + notes round-trip) FreeEed#553
• Viewer use case: FreeEed Viewer: portable production viewer with search and note-taking FreeEed#550

[markkerzner]

Production-side burn-in companion issue filed: shmsoft/FreeEed#554 (post-MVP). This issue (#69) covers redaction authoring as a non-destructive overlay during review; #554 covers permanently rendering those redactions into the produced set at production time. Burn-in is deferred until after the Viewer MVP (shmsoft/FreeEed#553).