feat(observability): 日志聚合后端 — logger环形缓冲 + GET /admin/observability/logs

- internal/logger/ring.go: Entry{time,level,source,msg} + RingBuffer(2000,满覆盖最旧,不阻塞)+ringHandler(slog旁路,Enabled委托内层,sourceOf提取source=再回落Scoped); Options.Ring非nil才包
- gateway/observability_logs.go: GET /admin/observability/logs?level=&limit= (writeAuth owner/admin) → {data:[{time(RFC3339 UTC),level,source,msg}]} 最新在前; level阈值过滤(warn=warn+error,已标注取舍); limit缺省200上限1000; 未知level400/未注入501
- routes.go注册 + observability.go SetLogBuffer(atomic.Pointer) + cmd/cyrene main.go/wireGatewayLogBuffer接线(logger先于gateway)
- 控制台/文件输出零变化; 记录只源自已产出日志,不额外打印敏感
- Docs/api-client v0.35; 测试(ring 10 + observability_logs 8 + cmd端到端2); build/vet/test绿(56)+win/darwin交叉编译

cmd/cyrene/main.go

@@ -70,7 +70,8 @@ func run() error {
 	if cfg.Env == "production" {
 		format = logger.FormatJSON
 	}
-	log := logger.New(logger.Options{Level: cfg.LogLevel, Format: string(format)})
+	logRing := logger.NewRingBuffer(logger.DefaultRingCapacity)
+	log := logger.New(logger.Options{Level: cfg.LogLevel, Format: string(format), Ring: logRing})
 	log = logger.WithSource(log, "main")
 
 	ctx, stop := platform.SignalContext()
@@ -80,6 +81,9 @@ func run() error {
 	if err != nil {
 		return err
 	}
+	// Observability log tail: the logger's ring buffer is built above (before the
+	// gateway), so hand it to the gateway now that the gateway exists.
+	wireGatewayLogBuffer(a, logRing)
 
 	if err := a.automation.Start(ctx); err != nil {
 		return fmt.Errorf("start automations: %w", err)