build(frontend)!: knip drops --production; plain knip stays

The production pass (7ed2ac4e, E32) asked "is this export used by what
ships?". No real hit: its only findings were 37 exports a test imports,
answered with 36 `@internal` JSDoc tags (E34 S2) — test-only exports, not
defects. Since then it has only ever asked for another tag. The tags go
with it (36, no longer read by anything), and so do the production-only
`!…!` exclusions in knip.jsonc and their register rows. Plain knip (unused
files, exports and dependencies) keeps running in the gate.

frontend/src/lib/log.ts

@@ -23,7 +23,6 @@ export type Level = "TRACE" | "DEBUG" | "INFO" | "WARNING" | "ERROR" | "CRITICAL
 
 /**
  * OpenTelemetry severity numbers — the same table as `logs.SEVERITY` (a contract test compares).
- * @internal exported for log.contract.test.ts
  */
 export const SEVERITY: Record<Level, number> = {
   TRACE: 1,
@@ -62,7 +61,6 @@ export interface LogEvent {
 
 /** Events kept. At ~0.5 KB each the ring stays around a megabyte — a long session's worth of
  *  navigation and requests, without growing for as long as a tab stays open. */
-/** @internal exported for log.test.ts */
 export const RING_MAX = 2000;
 
 // --- redaction (mirrors backend/app/logs.py) ------------------------------------------------------
@@ -101,7 +99,6 @@ function redactText(text: string): string {
 
 /** Recursively scrub a structure destined for the log. A value whose KEY names a secret is dropped
  *  whole — a prefix of a token is still a leak. Everything else is scrubbed as text. */
-/** @internal exported for log.contract.test.ts */
 export function redact(value: unknown, key = ""): unknown {
   const lowered = key.toLowerCase();
   if (key && SECRET_KEY_PARTS.some((part) => lowered.includes(part))) return REDACTED;