feat(diagnostics): the admin log console

Admin → Diagnostics reads the server's stored log: one list, newest first,
where a line opens in place to its full record (time, source and logger,
account, request and job ids, version, message, attributes, stack). A
request or job id narrows the list to that request or job with every other
filter off, shown as a removable chip. Filters: level group, source,
account, event, period and a free-text search; all of them live in the URL
(`l*` keys, which setPage clears like the Plex and Channels keys), so a
filtered view is a link and Back restores it. "Live" re-reads the newest
page every few seconds while the tab is visible; paging into older rows
turns it off. Copy puts the loaded lines on the clipboard as JSON lines.

The facet counts now honour every filter but their own, as the feed's do:
a request pivot narrows them, and a picked level does not zero its
siblings. A value in use stays offered even when the counts drop it.

"Saját napló" and the console draw a line with one shared component,
`LogLine`, whose phone layout gives the message its own full-width line
(sharing the code's line left it a few characters). The level groups
moved to lib/log.ts for both.

The console's own reads are logged at DEBUG on success, like the
healthcheck: at INFO its live tail filled the log with itself.

frontend/src/lib/api/admin.ts

@@ -1,6 +1,8 @@
 // The admin surface: discovery purge, system configuration, users & roles, the audit log, the
-// scheduler + maintenance controls, the demo-account whitelist, and access invites. Only touches
-// core's req. (Grouped by sub-area below; kept in one module as the cohesive "admin" domain.)
+// diagnostics console's server log, the scheduler + maintenance controls, the demo-account
+// whitelist, and access invites. Only touches core's req. (Grouped by sub-area below; kept in one
+// module as the cohesive "admin" domain.)
+import type { Level } from "../log";
 import { req } from "./core";
 
 export interface DemoWhitelistEntry {
@@ -115,6 +117,79 @@ export interface AuditListResult {
   returned: number;
 }
 
+/** One stored log line (`log_events`), as the diagnostics console reads it. Values the server's
+ *  redactor took out arrive as `[redacted]` / `[email]`. */
+export interface ServerLogRow {
+  id: number;
+  ts: string;
+  level: Level;
+  source: string;
+  logger: string;
+  event: string | null;
+  msg: string;
+  attrs: Record<string, unknown> | null;
+  exc: string | null;
+  request_id: string | null;
+  user_id: number | null;
+  job_id: number | null;
+  debug_session_id: string | null;
+  version: string | null;
+}
+
+/** The console's filters, as the API takes them. `none` picks the rows without an account / code. */
+export interface LogQuery {
+  levels?: readonly Level[];
+  sources?: readonly string[];
+  user?: string;
+  event?: string;
+  request_id?: string;
+  job_id?: number;
+  q?: string;
+  since?: string;
+}
+
+export interface LogPage {
+  items: ServerLogRow[];
+  /** The accounts this page names, by id; an erased one is absent. */
+  accounts: Record<string, string>;
+  next_cursor: string | null;
+}
+
+export interface LogFacet {
+  value: string;
+  count: number;
+}
+
+/** Each facet is counted under every filter but its own; `total` is the all-levels count. */
+export interface LogFacets {
+  levels: LogFacet[];
+  sources: LogFacet[];
+  events: LogFacet[];
+  users: LogFacet[];
+  accounts: Record<string, string>;
+  total: number;
+}
+
+function logParams(query: LogQuery, extra: Record<string, string | number | null> = {}): string {
+  const p = new URLSearchParams();
+  for (const level of query.levels ?? []) p.append("levels", level);
+  for (const source of query.sources ?? []) p.append("sources", source);
+  const single: Record<string, string | number | null | undefined> = {
+    user: query.user,
+    event: query.event,
+    request_id: query.request_id,
+    job_id: query.job_id,
+    q: query.q,
+    since: query.since,
+    ...extra,
+  };
+  for (const [key, value] of Object.entries(single)) {
+    if (value !== undefined && value !== null && value !== "") p.set(key, String(value));
+  }
+  const s = p.toString();
+  return s ? `?${s}` : "";
+}
+
 export interface SchedulerJob {
   id: string;
   interval_minutes: number;
@@ -172,6 +247,11 @@ export const adminApi = {
   // --- users & roles ---
   adminAudit: (limit = 500): Promise<AuditListResult> => req(`/api/admin/audit?limit=${limit}`),
   clearAudit: (): Promise<{ cleared: number }> => req("/api/admin/audit", { method: "DELETE" }),
+  // --- diagnostics console ---
+  adminLogs: (query: LogQuery, before: string | null): Promise<LogPage> =>
+    req(`/api/admin/logs${logParams(query, { before })}`),
+  adminLogFacets: (query: LogQuery): Promise<LogFacets> =>
+    req(`/api/admin/logs/facets${logParams(query)}`),
   adminUsers: (): Promise<AdminUserRow[]> => req("/api/admin/users"),
   setUserRole: (id: number, role: "user" | "admin"): Promise<AdminUserRow> =>
     req(`/api/admin/users/${id}/role`, { method: "PATCH", body: JSON.stringify({ role }) }),