[fionera]

Stacked on #63 so the privacy documentation can accurately describe support IDs.

What

• Replace plaintext source addresses in Go agent logs with a 128-bit, domain-separated HMAC pseudonym.
• Replace %ci in the example HAProxy log with a separately keyed 256-bit SHA-2 pseudonym.
• Add the BERGHAIN_SOURCE_LOG_KEY Compose setting and document production key requirements and retention limits.
• Correct the help page’s previous claim that nothing can survive cookie expiry.

Why

The omnibus branch reused the cookie HMAC and called low-entropy IP hashing irreversible. These values are pseudonymous, not anonymous: an operator with the key can enumerate IPv4 candidates, and ordinary infrastructure logs remain subject to operator retention.

Validation

• go test -race ./..., go vet ./..., and staticcheck ./...
• Both frontend builds and HAProxy config validation
• Live access-log test matched the keyed pseudonym and found no plaintext source address
• Full Compose privacy-log validation