fix(inference): #87 redact image bytes from inference_log

Log full text + image_ref (photo_id/seq/bytes) only; wire path still
sends data-URLs. Call 1/2 SELECT id+seq for refs. Cap is safety net
after redaction (METADATA-66).

docs/contracts/DATA-MODEL.md

@@ -160,6 +160,14 @@ Append-only; never deleted on publish. Columns: `id`, `slab_id`, `woo_product_id
 Append-only audit. Columns: `id`, `slab_id`, `call` (1 | 2), `prompt_revision_id` FK, `model`,
 `request_payload`, `response_payload`, `latency_ms`, `created_at`.
 
+`request_payload` is auditable JSON of the model request **without media bytes**
+(`METADATA-66`). Text parts (active prompt, LISTS / fact block, SKU/dims) are stored in full.
+Each vision attachment is an `image_ref` (`photo_id`, `seq`, `bytes`, optional
+`infer_long_edge_px`, `label`) pointing at `slab_photos` — never a
+`data:image/...;base64,...` URL. The wire request to the inference API still includes images;
+only the log is redacted. A byte cap remains as a safety net after redaction; normal Call 1/2
+rows are far under it.
+
 ## 10. Status transitions
 
 Cites APP-5.