fix(inference): #87 redact image bytes from inference_log

Log full text + image_ref (photo_id/seq/bytes) only; wire path still
sends data-URLs. Call 1/2 SELECT id+seq for refs. Cap is safety net
after redaction (METADATA-66).

docs/REQUIREMENTS.md

@@ -75,7 +75,7 @@ The listing is built in two inference calls, both optional. Call 1 (vision) read
 | METADATA-65 | The model never invents or alters a dimension; every number it prints comes from the fact block. | M3 | — |
 | METADATA-95 | The dimension-overlay image is never sent to the model. | M3 | — |
 | METADATA-70 | With inference off, the server produces the long description. | M3 | — |
-| METADATA-66 | Every content generation, from a deterministic pattern or from the model, is logged with its inputs, the model request and response when a model was used, and the final stored content. | M3 | — |
+| METADATA-66 | Every content generation, from a deterministic pattern or from the model, is logged with its inputs, the model request and response when a model was used, and the final stored content. The logged request keeps full text and photo refs only — never base64 image payloads. | M3 | backend/tests/test_inference.py |
 | METADATA-75 | Inference never blocks create and never auto-publishes. | M3 | — |
 | METADATA-105 | Inference prompts are stored in the database with all revisions; each call uses the active revision, the revision history is retained, and the revision used is recorded with the call. | M3 | — |
 | METADATA-106 | The prompt revision interface is a REST API: append a revision, activate a revision, and read the active prompt with its revision list. There is no prompt editing UI. | M3 | — |

docs/contracts/DATA-MODEL.md

@@ -160,6 +160,14 @@ Append-only; never deleted on publish. Columns: `id`, `slab_id`, `woo_product_id
 Append-only audit. Columns: `id`, `slab_id`, `call` (1 | 2), `prompt_revision_id` FK, `model`,
 `request_payload`, `response_payload`, `latency_ms`, `created_at`.
 
+`request_payload` is auditable JSON of the model request **without media bytes**
+(`METADATA-66`). Text parts (active prompt, LISTS / fact block, SKU/dims) are stored in full.
+Each vision attachment is an `image_ref` (`photo_id`, `seq`, `bytes`, optional
+`infer_long_edge_px`, `label`) pointing at `slab_photos` — never a
+`data:image/...;base64,...` URL. The wire request to the inference API still includes images;
+only the log is redacted. A byte cap remains as a safety net after redaction; normal Call 1/2
+rows are far under it.
+
 ## 10. Status transitions
 
 Cites APP-5.