feat(logs): app log store — backend pino DB sink + frontend error collection

Add a third data stream (app_logs), distinct from the signed ledger and device
telemetry, for operational/diagnostic logs — an offline appliance has no Sentry to
ship to, so the host is the log store.

Backend: a pino stream tees warn/error/fatal into app_logs (info/debug stay
stdout-only) with no call-site change; the DB is built before Fastify so the logger
has its sink. Frontend (lib/logger.ts): ships failed API requests (minus 401 churn),
window.onerror, unhandledrejection, and a top-level React ErrorBoundary; console
warn/error forwarded only at debug/trace. Batched/throttled POST, sendBeacon on
pagehide, loop-safe (never logs the /api/logs call), best-effort everywhere.

POST /api/logs (any signed-in user, CSRF, tolerant) + GET /api/logs gated by a new
log:read permission (new `log` RBAC resource; admin holds it). Retention: pruned by
age + row cap, hourly + at startup. UI: a Logs screen under /setup (filter
level/source/since, expand to context+stack), sq+en. Migration 0009_app_logs.

Verified end-to-end via app.inject: login -> POST 204 -> GET 200 with the record;
backend warn/error persisted, info dropped; non-admin GET 403 / POST 204.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

apps/web/src/router.tsx

@@ -27,6 +27,7 @@ import { SiteSettings } from "./SiteSettings.js";
 import { UsersManager } from "./UsersManager.js";
 import { RolesManager } from "./RolesManager.js";
 import { ShiftsHistory } from "./ShiftsHistory.js";
+import { LogsViewer } from "./LogsViewer.js";
 
 // Code-based TanStack Router (no file-based codegen — the app is small enough that
 // an explicit tree is clearer). The router context carries the signed-in user and
@@ -84,6 +85,7 @@ function SetupLayout() {
         {show("user:read") && <SetupTab to="/setup/users" label={t("nav.users")} />}
         {show("role:read") && <SetupTab to="/setup/roles" label={t("nav.roles")} />}
         {show("shift:read") && <SetupTab to="/setup/shifts" label={t("nav.shifts")} />}
+        {show("log:read") && <SetupTab to="/setup/logs" label={t("nav.logs")} />}
       </nav>
       <Outlet />
     </div>
@@ -363,6 +365,7 @@ const SETUP_TABS: { to: string; perm: Permission }[] = [
   { to: "/setup/users", perm: "user:read" },
   { to: "/setup/roles", perm: "role:read" },
   { to: "/setup/shifts", perm: "shift:read" },
+  { to: "/setup/logs", perm: "log:read" },
 ];
 
 // /setup is a LAYOUT route (tab bar + <Outlet>); the config screens are its
@@ -437,6 +440,14 @@ const shiftsHistoryRoute = createRoute({
   },
 });
 
+// Diagnostic logs. Gated by log:read (an admin/diagnostic permission).
+const logsRoute = createRoute({
+  getParentRoute: () => setupRoute,
+  path: "logs",
+  beforeLoad: ({ context }) => requirePerm("log:read")(context),
+  component: LogsViewer,
+});
+
 const routeTree = rootRoute.addChildren([
   indexRoute,
   boothRoute,
@@ -450,6 +461,7 @@ const routeTree = rootRoute.addChildren([
     usersRoute,
     rolesRoute,
     shiftsHistoryRoute,
+    logsRoute,
   ]),
 ]);