vc=37 (rust): scrub PII from strawcore info-logs

CVE round-2 HIGH-2: android_logger is configured at info-level in
release builds, so log::info!('strawcore::search query={}', query)
emits the user's actual search query to logcat. LogDump.scrubLine's
regex only catches googlevideo URLs + signed params — bare search
text rides through into a Settings → Export Logs share-sheet
attachment intact. Same for channel_info / stream_info URLs.

Replaced the value-bearing logs with shape-only (query_len /
input_len). The shape is enough to debug 'why did the search
return empty?' without the privacy hit.

rust/strawcore/src/search.rs

@@ -54,7 +54,12 @@ pub(crate) fn from_core(item: StreamInfoItem) -> SearchItem {
 
 #[uniffi::export(async_runtime = "tokio")]
 pub async fn search(query: String) -> Result<Vec<SearchItem>, StrawcoreError> {
-    log::info!("strawcore::search query={}", query);
+    // Don't log the query itself — searches are PII (sometimes
+    // names, sometimes embarrassing) and android_logger emits at
+    // info-level in release builds, which means they'd ride the
+    // Settings → Export Logs path straight into a user's chat. Log
+    // shape, not content. vc=36 audit CVE HIGH-2.
+    log::info!("strawcore::search query_len={}", query.len());
     let result = tokio::task::spawn_blocking(move || {
         search_extractor::search(&query, SearchFilter::Videos)
     })