Field-transform hooks in the data layer (encrypt / tokenize / redact selected fields)

Summary Add a small, opt-in extension point that lets a plugin or module transform selected fields on the way into MongoDB and on the way back out to a client. One registration point, consulted in three places the data already flows through: the model write path, the model read path, and the real-time message stream. The obvious first use is sealing a message's msg so the database holds ciphertext, but the same seam covers tokenization and role-based redaction of any field. This is deliberately vendor-neutral. The framework would ship the hook, not any particular crypto or provider. Motivation A chat server's most sensitive data is the message text itself, plus the personal fields around it. A growing number of self-hosted deployments want some of that to be ciphertext at rest (or tokenized, or redacted for people without a role), while the app keeps working with plaintext in-request. Concrete cases: • Field-level encryption against an external KMS, an H…