P2 pre-merge fixes: io_captured column, reconcile copy, harden security test

Fix 1: Add io_captured TINYINT(1) NOT NULL DEFAULT 0 to prv_call_meta
CREATE (baked into initial schema — table is new in v0.3.0, no separate
migration needed). PRV_Capture_Writer::write_io() sets io_captured=1 via
set_io_captured() on success; error rows and legacy rows keep 0.
Drawer state now driven by io_captured instead of config_version heuristic:
  0         → Legacy/not-captured
  1 + io    → Normal
  1 + no io → Pruned
ARCHITECTURE.md schema section updated.

Fix 2: Soften reconciliation copy in PRV_Costs_Renderer (~line 75):
'matches the Dashboard MTD total' → 'approximately reconciles to the
Dashboard MTD total' — error calls write prv_call_meta (cost 0) but not
prv_ai_visibility, so exact equality is not guaranteed.

Fix 3: Harden security test (test-capture-writer Test 4): inject sentinel
sk-or-TEST-LEAK-CANARY as PRV_OPENROUTER_API_KEY constant; queue a mocked
401 wp_remote_post response; drive PRV_Probe_Runner → PRV_Probe_Run_Executor
→ probe_one() 401 error path end-to-end; assert the sentinel, Bearer, and
Authorization appear in NO stored row (prv_call_meta or prv_call_io).
Original direct-writer security test retained as Test 3.

ARCHITECTURE.md

@@ -151,6 +151,7 @@ Admin page load ─────────────────────
 | http_status | INT | HTTP status (200=ok, 4xx/5xx=error) |
 | captured_at | DATETIME | UTC |
 | config_version | INT NULL | Config version at run time |
+| io_captured | TINYINT(1) | 1 when write_io() succeeded; 0 for error rows and legacy/pre-feature rows; drives drawer state (0=Legacy, 1+io present=Normal, 1+io absent=Pruned) |
 
 **Table:** `{prefix}prv_call_io` (pruned after retention window)