See what outside agents tried: a compact, redacted request log the owner can read #1061

Replaces #665, parked twice:

• the check stayed red through 2 automatic tries (pull #763 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.
• the check failed ("capacity: only a forge admin reads or changes it > an admin changes each one from the page, the API and MCP; a wrong value is refused; every change is kept") and the decider saw no point in another try (pull #1009 closed).

Those checks went red on tests this change does not touch. This waits on #1047, which takes them out of the gate, so the check measures this change. Start from today's main. What done looks like is #665's, unchanged:

---

Pillar: P5 Open to agents (umbrella #591). One run, from today's main.

Outcome. When an outside agent fails on a public app or repository, the owner can see what it tried. Today nothing records it: traefik has no access log, cloudflared logs no requests, the forge logs no requests, and pod logs go with each rollout. An outside agent tried to report a problem on a public repo this week and left no trace.

Acceptance.

• [ ] The forge writes one compact line per request that is not a static asset: time, host, method, path without query string, status, duration, user agent (truncated to 200 chars), signed-in or not, and a salted daily hash of the client address (never the raw address).
• [ ] Kept under /data as a rolling file for 14 days and size-capped, so it survives rollouts; never served publicly.
• [ ] The owner can read the last day's non-browser requests to public paths (/issues, /api/, /mcp, /.well-known/, /llms.txt, sign-in, sign-up) from one place: a page in settings and an MCP tool access {since, ua?, path?} for write-scoped tokens only.
• [ ] Tokens, cookies, and query strings never appear in the log. Test that.

Done means reachable: page (settings view), MCP (access), test (redaction + rotation), look (screenshot with a replayed non-browser request).

Parked by the crew: the check failed ("the forge over MCP > it speaks the protocol: initialize, a notification, ping, tools/list") and the decider saw no point in another try (pull #1231 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Parked by the crew: the check failed ("the gate's list > every test/*.test.ts is in exactly one list, and every entry exists") and the decider saw no point in another try (pull #1383 closed).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the check failed ("the forge over MCP > it speaks the protocol: initialize, a notification, ping, tools/list") and the decider saw no point in another try (pull #1231 closed)
2. the check failed ("the gate's list > every test/*.test.ts is in exactly one list, and every entry exists") and the decider saw no point in another try (pull #1383 closed)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Replaced by #1458: the same log, landed from pull #1383 on today's main, with access in the MCP tools/list expectation. Four of today's six parks went red on one test, the gate's list > every test/*.test.ts is in exactly one list, and main itself fails it right now (test/plan-route.test.ts is unlisted). #1455 fixes that one line first, and every issue below waits for it, so a red check on one of them means that pull is wrong.