Mask email addresses in logs

Mask email addresses in a log line to avoid leaking PII. Given a text string, replace every email address with a masked form that keeps the first character of the local part, replaces the rest of the local part with '*' (one star per hidden character), and leaves the '@domain' intact. An email is a run matching local@domain.tld where local is [A-Za-z0-9._%+-]+, domain is [A-Za-z0-9.-]+, and tld is at least 2 letters. If the local part is a single character, mask it entirely. Text with no emails is returned unchanged.