Private feed redaction misses quoted terminal-dot hostname aliases #441

A private feed address quoted in a metadata string can survive redaction when its hostname adds a terminal dot. The saved address and the quoted address reach the same DNS host, but canonicalUrl retains the dot, so the lookup does not match.

Reproduced in redactPrivateFeedAddresses at master 921be0d and with the PERF3 expression change. This predates PERF3. The publisher classifier already recognizes the dotted Supercast address as private.

const known = "https://priv3.supercast.com/feed/FAKE_SENTINEL.rss";
const document = {
  description: "Your private feed: https://priv3.supercast.com./feed/FAKE_SENTINEL.rss",
};
redactPrivateFeedAddresses(
  document,
  new Map([[known, "podnotes-private-feed:Paid"]]),
);

Expected the quoted address to become podnotes-private-feed:Paid. Actual output is the unchanged document, including the fake subscriber token. These are synthetic fixture addresses, not subscriber credentials.

The persistence encoder uses this helper to scrub known private feed addresses from arbitrary strings and unknown fields. Check terminal-dot canonicalization there while preserving distinct episode and signed-media URLs. Add behavior tests for quoted and standalone aliases, then run the privacy and persistence e2e suites.

Found during the PERF3 startup investigation. Kept separate because PERF3 preserves the existing regex and privacy behavior exactly.