Build redact-jsonl CLI that masks secret values in NDJSON

Build a dependency-free Node.js CLI named redact-jsonl that streams UTF-8 NDJSON from a file path or stdin to stdout, redacting values whose object keys match a configurable case-insensitive denylist. Default keys: password, token, secret, apiKey, authorization. Recurse through objects and arrays without mutating key names; replace matched values with the literal string [REDACTED]. Accept --keys comma-separated names and --input path, with --help. Emit exactly one compact JSON output line per nonblank valid input line in input order. Blank lines are ignored. On malformed JSON, report input line number to stderr, exit 1, and write no output for that bad line or any later line; prior valid lines may already have streamed. Invalid options or unreadable input exit 2 with a useful stderr message. Never print original secret values in errors. Include Node built-in tests for nested arrays, mixed key casing, custom keys, whitespace, malformed lines after valid lines, unreadable input, and stdin; README with usage examples. Do not use network access or modify input files.

Continue the existing redact-jsonl command-line tool from its delivered workspace. Add an optional --report flag: when present, after the stream ends the tool writes one JSON summary line to stderr with the number of input lines read, the number of lines that had at least one redacted value, the number of redacted values in total, the number of invalid (non-JSON) lines, and a per-key count of redactions with keys sorted alphabetically. The redacted stream on stdout must stay byte-identical to the current behaviour whether or not --report is given, and invalid lines keep their current handling. Add executable tests covering a stream with mixed valid and invalid lines, nested objects, and the default denylist, and document the flag in the README with one example command and its exact report line. Completion is observable by running the documented commands and the tests from a clean checkout.