feat(14-01): sunscreen redacting slog handler installed by every generated main

- Wrap redacts sensitive keys at any depth and scrubs Bearer, sk- and x-api-key shapes
- InstallDefault is the first statement of the generated run; hello main regenerated
- surf test pins that recovered panics echo no credential
- sunscreen README, root modules row and the logging docs page

examples/hello/main.go

@@ -15,6 +15,7 @@ import (
 	"git.golem15.com/golem15/summercms/modules/lagoon"
 	"git.golem15.com/golem15/summercms/modules/pact"
 	"git.golem15.com/golem15/summercms/modules/party"
+	"git.golem15.com/golem15/summercms/modules/sunscreen"
 	"git.golem15.com/golem15/summercms/modules/surf"
 )
 
@@ -26,6 +27,7 @@ func main() {
 }
 
 func run(args []string, out io.Writer) error {
+	sunscreen.InstallDefault(os.Stderr)
 	cfg, err := compass.Load("config")
 	if err != nil {
 		return err