Fix masked content not logged when secrets are detected

Fix masked content not logged when secrets are detected

Masked content was never stored whenever secrets were detected, ignoring
the log_masked_content setting. The dashboard then showed a misleading
"Masked content not logged (log_masked_content: false)" message.

With secrets_detection.action "mask" (the default), maskedContent already
has both PII and secrets replaced by placeholders by the time it reaches
the logger, so it is safe to store. Gate on log_masked_content plus
whether detected secrets were actually masked, via a pure
shouldLogMaskedContent helper. The secrets-masked condition keeps route
mode with action "route_local" safe: there secrets are intentionally left
raw for the trusted local provider and must never be persisted.

This also enforces log_masked_content centrally for the openai/anthropic/
codex routes, which previously passed masked content unconditionally.

The helper lives in its own module so the unit test can import it without
tripping over the wholesale logger mock used by other route tests.

Fixes #91