Add @Redacted field annotation for declarative cmd_body redaction
Field-level annotation as a declarative complement to `Redactable`.
```java
public record CreateInvoiceCmd(
...,
@Redacted byte[] attachment, // omit field
@Redacted(MASK) String accountNumber // mask value
) implements TenantCommand {}
```
Class-level `@Redacted` on the record = full body redaction (same effect as `Redactable.redactedForTracing()` returning `Optional.empty()`).
If a cmd uses both `@Redacted` and `Redactable`, the programmatic interface wins.
issue