echo: stop reflecting the full payload

While reviewing the timeout work I noticed echo returns its input verbatim and logs it. Payloads that reach a service can carry values the server set rather than the caller, so reflecting one wholesale is not a good default.

#635 covers this:

• echo runs its payload through the mask_secrets helper that already existed for Langfuse traces, and that helper now covers every field the server may fill in rather than only the one it fills in today
• masking moved to the boundary rather than sitting in one service, so a service that reflects its payload cannot leak by forgetting: service loggers mask what they emit, and every result leaves through one masked exit
• a test drives that exit through an unmounted probe that reflects its payload and masks nothing itself, so it fails if the boundary stops working rather than merely proving echo behaves

Closing when that merges.

Start with the related work in #635 and the existing mask_secrets helper used for Langfuse traces. Inspect the service loggers, the single result exit, and the unmounted probe test described in the issue. Done means reflected payloads and emitted logs are masked at the boundary, including fields the server may fill in.