feat(logs): app log store — backend pino DB sink + frontend error collection

Add a third data stream (app_logs), distinct from the signed ledger and device
telemetry, for operational/diagnostic logs — an offline appliance has no Sentry to
ship to, so the host is the log store.

Backend: a pino stream tees warn/error/fatal into app_logs (info/debug stay
stdout-only) with no call-site change; the DB is built before Fastify so the logger
has its sink. Frontend (lib/logger.ts): ships failed API requests (minus 401 churn),
window.onerror, unhandledrejection, and a top-level React ErrorBoundary; console
warn/error forwarded only at debug/trace. Batched/throttled POST, sendBeacon on
pagehide, loop-safe (never logs the /api/logs call), best-effort everywhere.

POST /api/logs (any signed-in user, CSRF, tolerant) + GET /api/logs gated by a new
log:read permission (new `log` RBAC resource; admin holds it). Retention: pruned by
age + row cap, hourly + at startup. UI: a Logs screen under /setup (filter
level/source/since, expand to context+stack), sq+en. Migration 0009_app_logs.

Verified end-to-end via app.inject: login -> POST 204 -> GET 200 with the record;
backend warn/error persisted, info dropped; non-admin GET 403 / POST 204.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

packages/db/src/schema.ts

@@ -356,6 +356,39 @@ export const sessions = sqliteTable("sessions", {
   lastEventIndex: integer("last_event_index"),
 });
 
+// --- Application logs (diagnostics, UNSIGNED, prunable) ------------------
+// A THIRD stream, distinct from the signed ledger_events (business facts) and
+// device_events (hardware telemetry): operational/diagnostic logs for debugging the
+// appliance. Backend warn/error/fatal (a Pino sink) AND frontend errors land here —
+// failed requests, uncaught exceptions, rejected promises — so a booth problem is
+// queryable from one place on an offline box. Never signed, never reconciled, pruned
+// by age + row cap. See wiki/concepts/app-logs.md, event-streams-split.md.
+export const appLogs = sqliteTable("app_logs", {
+  id: text("id").primaryKey(),
+  // pino levels: trace|debug|info|warn|error|fatal. We persist warn+ from the backend.
+  level: text("level", {
+    enum: ["trace", "debug", "info", "warn", "error", "fatal"],
+  }).notNull(),
+  // Which side produced it — the booth UI or the host.
+  source: text("source", { enum: ["frontend", "backend"] }).notNull(),
+  message: text("message").notNull(),
+  // Free-form structured detail: the failed request (path/method/status/body), the
+  // error name, component, anything the caller attaches. Kept in one JSON column.
+  context: text("context", { mode: "json" }).$type<Record<string, unknown>>(),
+  // Pulled out of context for cheap filtering of the common "failed request" case.
+  httpStatus: integer("http_status"),
+  path: text("path"),
+  // Captured stack trace, when there is one (uncaught errors / rejections).
+  stack: text("stack"),
+  // Who was logged in when it happened (frontend) / acted (backend), if known.
+  userId: text("user_id"),
+  // The browser/user-agent for a frontend log (triage which booth/device).
+  userAgent: text("user_agent"),
+  createdAt: text("created_at")
+    .notNull()
+    .default(sql`(current_timestamp)`),
+});
+
 export type UserRow = typeof users.$inferSelect;
 export type RoleRow = typeof roles.$inferSelect;
 export type RolePermissionRow = typeof rolePermissions.$inferSelect;
@@ -372,3 +405,4 @@ export type SubscriptionCredentialRow = typeof subscriptionCredentials.$inferSel
 export type SubscriptionPlateRow = typeof subscriptionPlates.$inferSelect;
 export type BlocklistRow = typeof blocklist.$inferSelect;
 export type SessionRow = typeof sessions.$inferSelect;
+export type AppLogRow = typeof appLogs.$inferSelect;