feat(observability): 日志聚合后端 — logger环形缓冲 + GET /admin/observability/logs

- internal/logger/ring.go: Entry{time,level,source,msg} + RingBuffer(2000,满覆盖最旧,不阻塞)+ringHandler(slog旁路,Enabled委托内层,sourceOf提取source=再回落Scoped); Options.Ring非nil才包
- gateway/observability_logs.go: GET /admin/observability/logs?level=&limit= (writeAuth owner/admin) → {data:[{time(RFC3339 UTC),level,source,msg}]} 最新在前; level阈值过滤(warn=warn+error,已标注取舍); limit缺省200上限1000; 未知level400/未注入501
- routes.go注册 + observability.go SetLogBuffer(atomic.Pointer) + cmd/cyrene main.go/wireGatewayLogBuffer接线(logger先于gateway)
- 控制台/文件输出零变化; 记录只源自已产出日志,不额外打印敏感
- Docs/api-client v0.35; 测试(ring 10 + observability_logs 8 + cmd端到端2); build/vet/test绿(56)+win/darwin交叉编译

internal/logger/logger.go

@@ -31,6 +31,10 @@ type Options struct {
 	Format string
 	// Out is the destination writer. Defaults to os.Stderr when nil.
 	Out io.Writer
+	// Ring, when non-nil, additionally captures every emitted record into a
+	// bounded ring buffer served by the admin observability log tail. The
+	// console/file output through Out is unchanged.
+	Ring *RingBuffer
 }
 
 // New builds a slog.Logger from opts.
@@ -49,7 +53,7 @@ func New(opts Options) *slog.Logger {
 		handler = slog.NewTextHandler(out, handlerOpts)
 	}
 
-	return slog.New(handler)
+	return slog.New(newRingHandler(handler, opts.Ring))
 }
 
 // ParseLevel maps a string level name to a slog.Level. Unknown or empty values