feat: Settings → Diagnostics, a consented log level and the tab's own log

A user can raise their diagnostics level to Részletes (DEBUG) or Teljes (TRACE) for 24 hours from a
new Settings tab, after a consent box that says what is recorded, that the server keeps it and for
how long (the instance's own retention), and that it lapses. Alap is the base and needs no consent.

- users.diagnostics_level/_until (migration 0087), written only by PUT /api/me/diagnostics, which
  computes the expiry itself; the demo account cannot raise it. /api/me reports the level in force.
- The server logs an elevated user's requests at that level and stores every line of them
  (logs.LevelGate on the stdout handler and the sink; the root is lowered only while an elevation
  is active). Teljes adds the redacted query string to the request line.
- POST /api/diagnostics/events stores the browser's log as source=web rows: account from the
  session, body capped while streaming, events/attrs capped, re-redacted, events under the
  consented level dropped, timestamps clamped, 30 batches a minute, 409 once the level lapsed.
- lib/diagnostics.ts applies the level to the tab and streams only what happens after consent, in
  batches, never its own request lines, with a keepalive flush on pagehide; stops on lapse (its
  own timer), on withdrawal and on 409.
- Detail hooks at DEBUG: which control was clicked (test id, icon, app copy in English — never user
  text, input values or a link's query), visibility/bfcache/resize, filter changes
  (lib/filterLog.ts; typed search only at TRACE), player events (lib/mediaLog.ts; media errors are
  warnings at every level). Offline/online at the base level.
- "Saját napló" viewer: live, newest first, level groups with counts, search, row details, copy
  the filtered events as JSON lines, clear.
- Privacy policy and Terms exist in Hungarian and English (a contract test holds both languages to
  the same sections); the policy now describes the server logs and diagnostic logging, self-service
  deletion and password sign-in.

Fixed on the way:
- A sync auth dependency ran logs.set_user on a copied context, so the account never reached a
  handler's own log lines (measured); a per-request mutable scope carries it now.
- The Settings tab rail left a phone no room (clipped labels, buttons over text): below `sm` it is
  a scrolling row above the content.
- PUT /api/me/preferences took a bare dict body; it is a Pydantic model now.

frontend/src/lib/diagnostics.ts

@@ -0,0 +1,123 @@
+// The user's consented diagnostics level, applied to this tab (E22 S5).
+//
+// `applyDiagnostics(me.diagnostics)` runs whenever `me` answers. It sets the client log's level, and
+// while that level is raised (Részletes / Teljes) it streams the log to the server:
+//   * only events kept AFTER the level was raised — the consent is for what happens from then on;
+//   * in batches, every FLUSH_MS or once BATCH_MAX are waiting, and the rest with a keepalive
+//     request when the tab closes;
+//   * never the lines about its own requests, or each batch would carry the previous one's;
+//   * and it stops at once when the level is lowered, when it lapses (a timer, not the next `me`
+//     refetch), or when the server answers that it is off.
+// A lost batch is dropped, not retried in a loop: this is a diagnostic stream, not a ledger, and a
+// retry storm against a struggling server is the last thing a diagnosis needs. The one exception is
+// being told to slow down (429): that batch goes back to the front of the queue.
+import { api, DIAGNOSTICS_EVENTS_PATH, HttpError, type DiagnosticsState } from "./api";
+import { log, setLevel, subscribe, type LogEvent } from "./log";
+
+const FLUSH_MS = 5_000;
+/** Per request. The server takes up to 200; staying under it leaves room for a burst. */
+const BATCH_MAX = 100;
+/** Waiting events kept while the server is slow or away; past it the oldest go. */
+const QUEUE_MAX = 1_000;
+
+/** The level actually in force: the consented one until it lapses. */
+export function levelInForce(state: DiagnosticsState | null | undefined, now = Date.now()) {
+  if (!state || state.level === "INFO" || !state.until) return "INFO";
+  return Date.parse(state.until) > now ? state.level : "INFO";
+}
+
+let applied: string | null = null;
+let lapseTimer: number | null = null;
+let onLapsed: (() => void) | null = null;
+
+/** Apply `state` to this tab. `lapsed` is called when a raised level runs out or the server says it
+ *  is off, so the caller can refetch `me` (and the Settings tab can show the base level again). */
+export function applyDiagnostics(
+  state: DiagnosticsState | null | undefined,
+  lapsed: () => void,
+): void {
+  onLapsed = lapsed;
+  const level = levelInForce(state);
+  const key = level === "INFO" ? "INFO" : `${level}@${state?.until}`;
+  if (key === applied) return;
+  const wasRaised = applied !== null && applied !== "INFO";
+  applied = key;
+  if (lapseTimer !== null) window.clearTimeout(lapseTimer);
+  lapseTimer = null;
+  if (level === "INFO") {
+    stopStreaming();
+    setLevel("INFO");
+    // Only a CHANGE is worth a line; every tab starts at the base level.
+    if (wasRaised) log.info("diagnostics.level", "diagnostics back at the base level", { level });
+    return;
+  }
+  setLevel(level);
+  startStreaming(); // first, so the stream opens with the line saying why it exists
+  log.info("diagnostics.level", "diagnostics level raised", { level, until: state?.until });
+  // setTimeout's delay is a signed 32-bit number; a longer wait would fire at once. The server
+  // grants 24 h, so the clamp only matters for a clock that is badly off.
+  const wait = Math.min(Date.parse(state!.until!) - Date.now(), 2 ** 31 - 1);
+  lapseTimer = window.setTimeout(lapse, wait);
+}
+
+function lapse(): void {
+  lapseTimer = null;
+  applied = "INFO";
+  stopStreaming();
+  setLevel("INFO");
+  log.info("diagnostics.level", "diagnostics level lapsed", { level: "INFO" });
+  onLapsed?.();
+}
+
+// --- streaming ----------------------------------------------------------------------------------
+let queue: LogEvent[] = [];
+let unsubscribe: (() => void) | null = null;
+let flushTimer: number | null = null;
+let inFlight = false;
+
+const isOwnRequest = (event: LogEvent) =>
+  event.event === "http.request" && event.attrs?.path === DIAGNOSTICS_EVENTS_PATH;
+
+function startStreaming(): void {
+  if (unsubscribe) return;
+  unsubscribe = subscribe((event) => {
+    if (!event || isOwnRequest(event)) return;
+    queue.push(event);
+    if (queue.length > QUEUE_MAX) queue.splice(0, queue.length - QUEUE_MAX);
+    if (queue.length >= BATCH_MAX) void flush();
+  });
+  flushTimer = window.setInterval(() => void flush(), FLUSH_MS);
+  window.addEventListener("pagehide", flushOnUnload);
+}
+
+function stopStreaming(): void {
+  unsubscribe?.();
+  unsubscribe = null;
+  if (flushTimer !== null) window.clearInterval(flushTimer);
+  flushTimer = null;
+  window.removeEventListener("pagehide", flushOnUnload);
+  // What was captured under the consent but not yet sent stays in the tab's own log, not the server's.
+  queue = [];
+}
+
+async function flush(): Promise<void> {
+  if (inFlight || !queue.length) return;
+  inFlight = true;
+  const batch = queue.splice(0, BATCH_MAX);
+  try {
+    await api.sendLogEvents(batch);
+  } catch (err) {
+    if (err instanceof HttpError && err.status === 429) {
+      queue.unshift(...batch);
+      if (queue.length > QUEUE_MAX) queue.length = QUEUE_MAX;
+    } else if (err instanceof HttpError && err.status === 409) {
+      lapse(); // the server has it off: withdrawn in another tab, or lapsed by its clock
+    }
+  } finally {
+    inFlight = false;
+  }
+}
+
+function flushOnUnload(): void {
+  while (queue.length) api.sendLogEventsOnUnload(queue.splice(0, BATCH_MAX));
+}