feat: client log with request ids, joined to the server's

The browser now keeps its half of the one event shape logs.py defines:
lib/log.ts is a levelled, redacted, bounded (2000 events) in-memory ring
with the server's level names and severity numbers. Nothing leaves the
browser yet; sending is the consented diagnostics level (S5).

- lib/http.ts `send` is the one fetch: every request carries an
  X-Request-Id and becomes one http.request event. The server echoes the
  matched route template in X-Route (only for a matched route, so a raw
  path with a value in it is never sent back); without one the client
  templates the path itself. req, beacon, the upload XHR, the public
  watch page and the legal pages all go through it.
- Hooks: app start snapshot, uncaught errors and rejections, History
  push/replace/popstate (a scroll-only replace is not an event; parameter
  values only at DEBUG, typed search only at TRACE), notifications, the
  error dialog, the crash boundary, failed queries and mutations (key
  head only), and the messages socket (lifecycle, frame types at DEBUG).
- Redaction is one contract: backend/tests/fixtures/log_redaction_cases.json
  runs against both redact() implementations.
- Lint: fetch, XMLHttpRequest and WebSocket each belong to one logging
  module, console to none; a contract test proves the rules fire.

Fixes a socket takeover: the close of a socket released by the last
subscriber cleared the newer socket a quick re-subscribe had opened and
scheduled a third, leaving two live sockets that delivered every message
twice (measured in Chromium: 3 created / 2 live before, 2 / 1 after).

frontend/src/lib/api/core.ts

@@ -7,6 +7,8 @@ import i18n from "../../i18n";
 import { formatBytes } from "../format";
 import { reportError } from "../errorDialog";
 import { activeAccountId, pinActiveAccount } from "../activeAccount";
+import { logRequest, REQUEST_ID_HEADER, ROUTE_HEADER, send } from "../http";
+import { newRequestId } from "../log";
 
 /** The active UI language, as a bare code the server understands ("en"/"hu" — never "en-GB").
  *  Lives here so the request builders can stamp it themselves: a signal that has to be passed in by
@@ -247,7 +249,7 @@ export const getActiveAccount = activeAccountId;
 export function beacon(url: string, body: Record<string, unknown>): void {
   const active = getActiveAccount();
   try {
-    void fetch(url, {
+    void send(url, {
       method: "POST",
       keepalive: true,
       credentials: "include",
@@ -277,16 +279,20 @@ export async function req<T = unknown>(
     let r: Response;
     try {
       const active = getActiveAccount();
-      r = await fetch(url, {
-        credentials: "include",
-        headers: {
-          "Content-Type": "application/json",
-          // Per-tab identity override (only setup calls pass their own headers, and those are
-          // pre-auth, so this is safe to put in the defaults that `...opts` may replace).
-          ...(active != null ? { [ACTIVE_ACCOUNT_HEADER]: String(active) } : {}),
+      r = await send(
+        url,
+        {
+          credentials: "include",
+          headers: {
+            "Content-Type": "application/json",
+            // Per-tab identity override (only setup calls pass their own headers, and those are
+            // pre-auth, so this is safe to put in the defaults that `...opts` may replace).
+            ...(active != null ? { [ACTIVE_ACCOUNT_HEADER]: String(active) } : {}),
+          },
+          ...opts,
         },
-        ...opts,
-      });
+        attempt ? { attempt: attempt + 1 } : {},
+      );
     } catch (e) {
       // Network-level failure (incl. a keepalive connection reset surfacing as a TypeError).
       if (canRetry && attempt === 0) {
@@ -349,6 +355,9 @@ export function uploadReq<T = unknown>(
     const xhr = new XMLHttpRequest();
     xhr.open("POST", url);
     xhr.withCredentials = true;
+    const requestId = newRequestId();
+    const started = performance.now();
+    xhr.setRequestHeader(REQUEST_ID_HEADER, requestId);
     const active = getActiveAccount();
     if (active != null) xhr.setRequestHeader(ACTIVE_ACCOUNT_HEADER, String(active));
     if (cfg.onProgress) {
@@ -361,6 +370,11 @@ export function uploadReq<T = unknown>(
       cfg.signal.addEventListener("abort", () => xhr.abort());
     }
     xhr.onload = () => {
+      logRequest(requestId, "POST", url, started, {
+        status: xhr.status,
+        // Test doubles may not implement it; a real XHR always does.
+        route: xhr.getResponseHeader?.(ROUTE_HEADER),
+      });
       if (!RETRIABLE_GATEWAY.has(xhr.status)) markConnectivityRestored(); // as in `req`
       if (xhr.status >= 200 && xhr.status < 300) {
         try {
@@ -388,10 +402,14 @@ export function uploadReq<T = unknown>(
     };
     // A network-level failure (server unreachable) — same soft "connection lost" status as `req`.
     xhr.onerror = () => {
+      logRequest(requestId, "POST", url, started, { failed: "network" });
       markConnectivityLost();
       reject(new HttpError(0, i18n.t("errors.offline.body")));
     };
-    xhr.onabort = () => reject(new HttpError(0, ABORTED));
+    xhr.onabort = () => {
+      logRequest(requestId, "POST", url, started, { failed: "aborted" });
+      reject(new HttpError(0, ABORTED));
+    };
     xhr.send(form);
   });
 }