Client-side masking. Applies configured rules to an outgoing payload's maskable fields for the record_type, then runs the optional user hook.

Payload keys are ATOMS matching the writers' payloads / intake wire keys.

Each rule is a map (atom-keyed) with:

• :target — one of "request_body", "request_headers", "path", "response_body", "error_message"; mapped to a wire key per @field_map.
• :path — a JSONPath string (or nil/""): selects node(s) to mask.
• :regex — a regex string (or nil/""): substitutes within string leaves.
• :replacement_value — literal replacement string (blank ⇒ "...").

Matching semantics ("path scopes, regex matches within"):

• path only — replace each node selected by the path entirely.
• regex only — global regex substitution on every string leaf.
• path + regex — within each selected node, regex-substitute string leaves.

Bad regex or unparseable path make the rule a no-op. For non-JSON body values, :path no-ops and :regex (if valid) applies to the raw string; never raise.