The forge keeps its own errors: the last hour's error lines are counted and the latest few are readable in health #359

/api/v1/health now reports the forge's own errors: the last hour's count and the five latest lines. I didn't get a clean full bun test, so I can't say the whole suite is green on this branch.

• Full suite: it ran 1951 tests with 17 failures and 4 errors. The output was cut off, so I couldn't see which failed. I then ran the suites my change touches (scaffold, contract, snapshot, vitals): 41 passed and 1 failed. That one is the scaffolded app's strict typecheck, and it fails the same way with my change stashed. I don't know whether the other failures from the full run are also pre-existing.
• What log.error keeps: src/kernel/log.ts holds the 100 most recent error lines in memory (ERROR_RING). Each line is scope, message and time, and the message has already been through redactSecrets. Nothing goes to disk.
• Hourly counts: counts are kept per scope in one-minute buckets and pruned as they age, so the last-hour figure stays exact even after the ring has rolled over.
• Health answer: errors: { lastHour, latest: [{ at, scope, message }] }, newest first. When there are 20 or more errors in an hour (ERROR_BURST in src/kernel/vitals.ts), needs gets a sentence saying so.
• console.error calls: all 13 are left as they are, each with a one-line reason. They are CLI output, git hook stderr that git shows to whoever pushed, or code inside generated apps. None runs inside the forge server, so none belongs in createLog.
• Tests: test/vitals.test.ts gains a test that logs a ghp_… token and checks the health answer holds [redacted] and never the secret. The same test checks the ring stops at 100, the count and burst sentence appear, and the count drops to 0 two hours later. The existing shape test now expects the errors key.
• Not done: the ring and counts reset when the process restarts. The count is per process, not across restarts. I added no dependencies.

To try it, log an error from any scope and read /api/v1/health as an admin.

🤖 Generated with Claude Code

Closes #344