feat(host,web): host log ring + GET /api/v1/logs + console Logs page

Remote debugging without shell access: a tracing layer tees every
event at DEBUG-and-up — independent of the RUST_LOG filter gating
stderr/host.log, so console-side debugging never needs a restart —
into a bounded in-memory ring (log_capture.rs, 4096 newest entries,
OnceLock singleton like config()), installed at both init sites
(stderr path in main, the Windows service file path). The mgmt API
serves it cursor-paged at GET /api/v1/logs?after=&limit= — bearer-only
and deliberately NOT on the mTLS cert allowlist (log lines can name
client identities and host paths). The web console grows a Logs page
(follow/pause · min-level filter · text search · eviction-gap badge);
polling self-paces: a non-empty page advances the after-cursor (new
query key → immediate refetch, drains backlogs), an empty page idles
at the 2s interval. OpenAPI regenerated; ring pagination/eviction,
layer wiring, and the authed route are unit-tested; Storybook story
included.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

web/messages/en.json

@@ -121,6 +121,15 @@
 	"login_signing_in": "Signing in…",
 	"action_logout": "Sign out",
 	"nav_stats": "Performance",
+	"nav_logs": "Logs",
+	"logs_title": "Logs",
+	"logs_subtitle": "The host's recent log stream — follow live, filter by level, search.",
+	"logs_follow": "Follow",
+	"logs_pause": "Pause",
+	"logs_clear": "Clear",
+	"logs_search": "Search logs…",
+	"logs_empty": "No log entries match — adjust the filter or wait for host activity.",
+	"logs_dropped": "Some entries were evicted before they could be fetched",
 	"stats_title": "Performance",
 	"stats_subtitle": "Record a session's pipeline timings and review them as graphs.",
 	"stats_capture_title": "Capture",