feat(observability): analytics hooks for shield decisions

Goal: expose optional analytics hooks for rate-limit, bot, and csrf decisions.

Scope:
- Add hook callbacks for allow, deny, and challenge events.
- Emit normalized payloads without secrets.
- Keep hooks optional and low overhead.

Acceptance criteria:
- Typed hook payloads.
- Tests for invocation order and payload correctness.
- README examples for basic integration.

The issue does not name files or entry points; start by locating the rate-limit, bot, and CSRF decision paths and the existing test and README structure. Add optional hooks with typed, secret-free payloads, then verify invocation order and payload correctness and document basic integration.

Written by the indexing model from the issue text.