mod: consider adding URLs to PIIParsers (or a SensitiveParsers preset) #7

URLs are excluded from the PII preset even though they routinely carry reset tokens, user IDs, signed query parameters, and credentials.

Current state

• PIIEntity excludes URLEntity (mod.ts:96-115)
• PIIParsers excludes URL.parser (mod.ts:130-158)
• Playground PII preset also excludes URL (docs/src/registry.ts:69-82)
• URL redaction is only tested via an explicitly selected parser (tests/redact.test.ts:116-122)

Open design question
Adding URL.parser wholesale would also redact every innocent bare domain. Options:

1. Add protocol-qualified URLs only to PIIParsers (split URL.Full from URL.Bare in the preset)
2. Keep PIIParsers as-is (direct identifiers) and introduce a broader SensitiveParsers preset (URLs, and possibly quasi-identifiers like Location/Institution)
3. Both: preset split + documentation of what counts as PII vs quasi-identifier

Tests to add

• Chosen preset redacts https://example.com/reset?token=...
• It does not redact a bare domain if the policy is full-URL-only
• Public type test confirming which entities belong to each preset

Depends on: url recall issue (authority split makes the full/bare distinction cleaner).