fix(insights): sanitizer warning — raise threshold + add real leak signal

The previous 500-token threshold fired on virtually every authenticated
session because rrweb masks inputs at source and stripQuery() removes
URL params before sanitize() runs — so 0 matches is the normal case,
not an anomaly. Confirmed on session 019e455e: 9m32s authed session
with ~1093 tokens, 0 matches, no actual PII leak.

- Raise broad threshold 500→2000 tokens
- Add precise leak detector: any unmasked \`input [tag] "text"\` line
  in the compressed timeline AND authed AND 0 matches → alert. This
  catches the actual failure mode (PostHog source-side masking broken)
  instead of guessing from total token volume.
- Sync UI warning threshold to match (500→2000).

apps/web/src/app/insights/sessions/[id]/page.tsx

@@ -84,7 +84,7 @@ export default async function SessionDetailPage({
       {s.compressed && (
         <div className="text-xs text-muted-foreground">
           tokens: ~{s.compressed.tokenCountInput} · PII matches: {s.compressed.sanitizationMatchCount}
-          {s.compressed.sanitizationMatchCount === 0 && s.compressed.tokenCountInput > 500 && (
+          {s.compressed.sanitizationMatchCount === 0 && s.compressed.tokenCountInput > 2000 && (
             <span className="ml-2 text-amber-600">⚠ zero PII matches with large output</span>
           )}
         </div>