fix(privacy): stop logging user objects, usernames, and study identifiers

## Problem
(verified) `info(... user: $user)` logs the full user — including token via `toString`/JSON — at `lib/data/carp_backend.dart:67`, `:96`, `:109`, `:119`; username on consent failure (:234); full study object (:173; `lib/blocs/app_bloc.dart:521`); the router redirect debug-prints auth state on every navigation (`lib/carp_study_app.dart:37-40`). Console-only today, but the crash-reporting EPIC will start shipping these off-device.

## Proposed fix
Log stable non-PII identifiers only (account-id hash, deployment id where needed for support); add a scrubbing convention before breadcrumb forwarding; remove the redirect debugPrints or gate behind debug level.

## Acceptance criteria
- [ ] `grep -rn '\$user\|\$username\|\$study' lib/` shows no log-string hits
- [ ] Review checklist item added

**Effort:** S · **Priority:** P1 · **Change risk:** None