feat(logs): support the log view outside systemd

[moebiusband73]

The admin log view shelled out to journalctl unconditionally, so it was silently broken wherever cc-backend does not run as a systemd unit: the navbar entry and the page rendered for every admin and the endpoint answered with a 500.

Add internal/logviewer, which resolves a log source once at startup:

• journal: the previous journalctl path, used when this process actually runs as a systemd unit (INVOCATION_ID, JOURNAL_STREAM or NOTIFY_SOCKET set) and journalctl is available.
• memory: an in-process ring buffer fed from cc-lib's per-level loggers, used everywhere else. A container cannot read its own runtime log, and a log file inside a container duplicates the stdout stream the platform already collects, so keeping the records in process is the option that works in a container, under a supervisor and from a plain shell alike.
• disabled: opt-out via configuration, which also hides the navbar entry and makes the endpoint answer 503 with an explanation.

The sink is installed right after cclog.Init and released again if the configuration selects another backend, so the startup log an admin needs for debugging is captured. Attaching one sink per level keeps the exact syslog priority without parsing, and levels cc-lib routes to io.Discard are skipped so the buffer honours -loglevel.

The ring preallocates its records and a byte arena and copies each line into its slot, so logging stays allocation free in steady state: 43 ns per record, 0 allocs (BenchmarkRingAppend), which is what the sink adds to a log call that is already inside log.Logger's mutex around a write to stderr.

New configuration keys main.log-source (auto|journal|memory|disabled, default auto) and main.log-buffer-size (default 4096). While moving the journalctl code, check scanner.Err() and raise the scanner limit so one long record no longer truncates the result silently.