Add stable document-local aliases for sensitive values

The API can mask text, but token mode is still a placeholder. Implement document-local aliases so repeated exact values share a token and distinct values stay distinct. Keep kinds separate, preserve case and avoid storing sensitive values beyond the request.

Work with the stack you want to practice. Your workspace and timer start after you choose.