The forge keeps its own errors: the last hour's error lines are counted and the latest few are readable in health #344

Part of #334 (1, Observability: "the forge's own errors"). Today log.error writes a line to stdout and is gone; nobody looking at the forge can tell it has been failing.

Done when

• [ ] src/kernel/log.ts keeps, in memory, a bounded ring of the most recent error lines (scope, message, time — already passed through redactSecrets) and a count per scope for the last hour; nothing new is written to disk
• [ ] the ring is bounded (e.g. 100 lines) and a test proves it cannot grow past it
• [ ] /api/v1/health gains errors: { lastHour, latest: [{ at, scope, message }] } (latest five), and a burst (stated threshold) adds a sentence to needs
• [ ] a test logs a credential-shaped error and asserts the health answer holds [redacted], never the secret
• [ ] the 13 bare console.error calls in src/ either go through createLog or are left with a one-line reason

Files: src/kernel/log.ts, src/kernel/vitals.ts, the console.error call sites, tests. Risks: secrets in error text (redaction is the floor); memory growth (the ring's bound). Brief: a server-side builder.