- Drop HashedIP field and hashIP function from the server; no IP is
collected or stored at all
- Remove email from report.json; if the user supplies a contact address
it is written to mail.eml in the report directory instead, keeping PII
separate from the structured report data
- Remove unused imports (crypto/sha256, encoding/hex, strings)
Closes#441
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>