almost leaked a client’s API keys to Gemini, so I built a zero‑trust AI workspace with local PII scrubbing and side‑by‑side model streaming