feat: client log with request ids, joined to the server's

The browser now keeps its half of the one event shape logs.py defines:
lib/log.ts is a levelled, redacted, bounded (2000 events) in-memory ring
with the server's level names and severity numbers. Nothing leaves the
browser yet; sending is the consented diagnostics level (S5).

- lib/http.ts `send` is the one fetch: every request carries an
  X-Request-Id and becomes one http.request event. The server echoes the
  matched route template in X-Route (only for a matched route, so a raw
  path with a value in it is never sent back); without one the client
  templates the path itself. req, beacon, the upload XHR, the public
  watch page and the legal pages all go through it.
- Hooks: app start snapshot, uncaught errors and rejections, History
  push/replace/popstate (a scroll-only replace is not an event; parameter
  values only at DEBUG, typed search only at TRACE), notifications, the
  error dialog, the crash boundary, failed queries and mutations (key
  head only), and the messages socket (lifecycle, frame types at DEBUG).
- Redaction is one contract: backend/tests/fixtures/log_redaction_cases.json
  runs against both redact() implementations.
- Lint: fetch, XMLHttpRequest and WebSocket each belong to one logging
  module, console to none; a contract test proves the rules fire.

Fixes a socket takeover: the close of a socket released by the last
subscriber cleared the newer socket a quick re-subscribe had opened and
scheduled a third, leaving two live sockets that delivered every message
twice (measured in Chromium: 3 created / 2 live before, 2 / 1 after).

backend/app/logs.py

@@ -391,7 +391,7 @@ async def log_requests(request, call_next):
     What changes versus `uvicorn.access`: the ROUTE TEMPLATE instead of the concrete path (so
     `/api/videos/{video_id}` groups), never the query string (it carried `?account=`, and at TRACE
     the redacted query belongs in attrs, not in the URL), a request id echoed back in
-    `X-Request-Id`, the duration, and the account — read from `request.state`, which the auth
+    `X-Request-Id` (with the template in `X-Route`), the duration, and the account — read from `request.state`, which the auth
     dependency fills, because this middleware sits outside both the session middleware and the
     downstream task's context."""
     incoming = request.headers.get("x-request-id", "")
@@ -446,6 +446,13 @@ async def log_requests(request, call_next):
         },
     )
     response.headers["X-Request-Id"] = rid
+    # The template, so the browser's copy of this line groups the same way (frontend lib/http.ts).
+    # Only a MATCHED route's: a template never carries a path parameter's value (a share token stays
+    # `{token}`), while the raw-path fallback of an unmatched request could — the browser then
+    # templates the path itself.
+    matched = _matched_route(request)
+    if matched:
+        response.headers["X-Route"] = matched
     _request_id.reset(token)
     return response
 
@@ -471,8 +478,12 @@ def _request_owner(request, level: int) -> dict[str, Any]:
     return {} if _anonymous_lines.allow(client_key(request)) else {PERSIST: False}
 
 
+def _matched_route(request) -> str | None:
+    """The matched route's template (`/api/videos/{video_id}`), or None when nothing matched."""
+    return getattr(request.scope.get("route"), "path", None)
+
+
 def _route_template(request) -> str:
-    """The matched route's template (`/api/videos/{video_id}`), else the raw path for a 404 or a
-    static file. Never the query string."""
-    route = request.scope.get("route")
-    return getattr(route, "path", None) or request.url.path
+    """The matched route's template, else the raw path for a 404 or a static file. Never the query
+    string."""
+    return _matched_route(request) or request.url.path