fix(audio): real device names are not labelSafe pseudonyms (#33)

Codex review of #32: the audio-session sanitizer (_safeInputLabel) returns
`labelPseudonym` UN-redacted (it's assumed already safe), so putting a raw OS
device name there leaks PII (e.g. "Byron's AirPods") to diagnostics/consumers
regardless of labelSafe. Put the real name in `label` instead — the field the
sanitizer can redact for suspicious/PII-looking names — and mark labelSafe only
for the generic "Desktop input N" fallback.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/renderer/screen.js

@@ -325,7 +325,8 @@ window.__slopsmithDesktopAudioHooks = window.__slopsmithDesktopAudioHooks || {};
             const inputs = Array.isArray(typeInfo && typeInfo.inputs) ? typeInfo.inputs : [];
             inputs.forEach((deviceName, index) => {
                 const logicalSourceKey = `desktop-audio:${safeKeyPart(typeName)}:input:${index}`;
-                const realName = (typeof deviceName === 'string' && deviceName.trim())
+                const hasRealName = (typeof deviceName === 'string' && !!deviceName.trim());
+                const realName = hasRealName
                     ? deviceName.trim()
                     : `Desktop input ${index + 1}`;
                 audioSession.registerInputSource({
@@ -334,8 +335,20 @@ window.__slopsmithDesktopAudioHooks = window.__slopsmithDesktopAudioHooks || {};
                     providerId: 'audio_engine',
                     ownerPluginId: 'audio_engine',
                     kind: 'instrument',
-                    labelPseudonym: realName,
-                    labelSafe: true,
+                    // Real OS device names go in `label`, which the audio-session
+                    // sanitizer (_safeInputLabel) can redact for diagnostics /
+                    // suspicious names. `labelPseudonym` is for already-safe
+                    // pseudonyms and is returned UN-redacted, so putting a real
+                    // name there would bypass redaction and leak PII (e.g.
+                    // "Byron's AirPods"). Only the generic fallback is labelSafe.
+                    label: realName,
+                    labelSafe: !hasRealName,
+                    // Safe per-index fallback used when the audio-session
+                    // sanitizer redacts a suspicious real name (e.g. one
+                    // containing "Device" or 4+ digits), so redacted inputs stay
+                    // distinguishable instead of collapsing to one generic label.
+                    pseudonym: `Desktop input ${index + 1}`,
+                    diagnosticsPseudonym: `Desktop input ${index + 1}`,
                     availability: 'available',
                     sourceMode: 'native',
                     channelSummary: { channelCount: 2, channelShape: 'stereo', supports: ['mono', 'stereo'] },