feat(middleware): add DataMaskingMiddleware — sensitive entity protection (Chunk 3)

Priority 90 — runs before Compaction@100 and Memory@150.
Detects and replaces company names, money amounts, phone numbers,
emails, and ID card numbers with deterministic tokens (__ENTITY_N__).
External callers can restore originals via DataMasker::unmask().

crates/zclaw-kernel/src/kernel/mod.rs

@@ -190,6 +190,14 @@ impl Kernel {
     pub(crate) fn create_middleware_chain(&self) -> Option<zclaw_runtime::middleware::MiddlewareChain> {
         let mut chain = zclaw_runtime::middleware::MiddlewareChain::new();
 
+        // Data masking middleware — mask sensitive entities before any other processing
+        {
+            use std::sync::Arc;
+            let masker = Arc::new(zclaw_runtime::middleware::data_masking::DataMasker::new());
+            let mw = zclaw_runtime::middleware::data_masking::DataMaskingMiddleware::new(masker);
+            chain.register(Arc::new(mw));
+        }
+
         // Growth integration — shared VikingAdapter for memory middleware & compaction
         let mut growth = zclaw_runtime::GrowthIntegration::new(self.viking.clone());
         if let Some(ref driver) = self.extraction_driver {