RedactForSession also clears the camera serial, XMP DocumentID, and per-file InstanceID for shared-only/unregistered sessions, matching common EXIF/XMP privacy practice; FileName, PhotoUID, and FileUID are kept.
GetPhoto returns a reduced view for sessions limited to shared content: album membership is restricted to the albums shared with the session, and labels, people, and owner/storage metadata are omitted. Full-access sessions are unaffected. Adds Photo.RedactForSession, in preparation for upcoming sharing features.
