feat(api): stream serve daemon logs

[ymote]

Summary

• Adds GET /api/admin/serve/logs as an admin-auth SSE stream for the main daemon rolling log.
• Supports bounded initial replay with tail_n, case-insensitive whole-line regex grep, RFC3339 since, simple poll-based live tail, daily log rotation detection, and line redaction for common credential patterns.
• Documents the daemon-log curl shape alongside the existing gateway log stream docs.

Closes #904

Current refresh

• Base: origin/main 1df02bd
• Head: 5edab6a
• Refreshed from a clean isolated clone; no generated artifacts or untracked files included.

Validation

• git diff --check origin/main...HEAD
• rustfmt --check crates/octos-cli/src/api/admin.rs crates/octos-cli/src/api/router.rs
• cargo fmt --all -- --check
• CARGO_TARGET_DIR=/private/tmp/octos-1226-refresh-target CARGO_INCREMENTAL=0 CARGO_PROFILE_DEV_DEBUG=0 cargo test -p octos-cli --features api serve_log -- --nocapture (3 passed)
• CARGO_TARGET_DIR=/private/tmp/octos-1226-refresh-target CARGO_INCREMENTAL=0 CARGO_PROFILE_DEV_DEBUG=0 cargo check -p octos-cli --features api --all-targets (passes with existing unrelated warning noise)
• CARGO_TARGET_DIR=/private/tmp/octos-1226-refresh-target CARGO_INCREMENTAL=0 CARGO_PROFILE_DEV_DEBUG=0 cargo clippy -p octos-cli --features api --all-targets --no-deps (exits 0 with existing unrelated clippy warning noise)
• git status --short --branch and git ls-files --others --exclude-standard in the isolated clone show no untracked/generated files.

Notes

• Full clippy with -D warnings remains blocked by pre-existing warnings outside this slice, so this refresh records the clean exit of the repository-standard clippy invocation without widening the PR.

CI / merge status

• GitHub CI is green on head 5edab6a69f7d0ad31cbac9a7b346d0de369168f2: check, test-octos-cli, test-octos-agent (lib), test-octos-agent (integration), dashboard, swarm-app, check-matrix, typos, and author-email passed. Optional platform/e2e/security expansion jobs were skipped by workflow conditions.
• Current GitHub state remains MERGEABLE but branch-protection blocked by required review (BLOCKED / REVIEW_REQUIRED).
• feat(api): /api/admin/serve/logs SSE endpoint for live-tail of main daemon log #904 should close through this PR after review and merge; no manual closure was performed.

[ymote]

Current-main validation refresh for #904.

Scope validated:

• Base/current main: 1fb4c88e020242d82cee245b331798ed6dc551e7 (also confirmed with git ls-remote https://github.com/octos-org/octos.git refs/heads/main)
• PR head: dfaeccc7e81a3bb8a584f04a6f7ec623d118f9cc
• Local rehearsal merge: 43e8a97b7b7bb29daf259b13c8b4b4210d4f4b07
• Rehearsal clone: /private/tmp/octos-1226-current-Qedh06 (standalone clone; root checkout left untouched)
• Changed files: crates/octos-cli/src/api/admin.rs, crates/octos-cli/src/api/router.rs, docs/user-guide.md, docs/user-guide-zh.md

Commands run:

• git fetch https://github.com/octos-org/octos.git pull/1226/head
• git merge --no-edit FETCH_HEAD clean on current local main
• git diff --check origin/main...HEAD
• rustfmt --check crates/octos-cli/src/api/admin.rs crates/octos-cli/src/api/router.rs
• cargo fmt --all -- --check
• CARGO_TARGET_DIR=/private/tmp/octos-1226-current-1fb4-target CARGO_INCREMENTAL=0 cargo test -p octos-cli --features api serve_log -- --nocapture
• CARGO_TARGET_DIR=/private/tmp/octos-1226-current-1fb4-clippy-target CARGO_INCREMENTAL=0 cargo clippy -p octos-cli --features api --all-targets --no-deps
• git ls-files --others --exclude-standard

Results:

• Rehearsal merge was clean.
• git diff --check passed.
• Touched Rust files passed rustfmt --check.
• Focused serve-log tests passed: 3/3 (serve_log_replay_filters_by_since_grep_and_tail, serve_log_redaction_masks_credentials, serve_log_tail_reads_only_appended_complete_lines).
• cargo clippy -p octos-cli --features api --all-targets --no-deps exited 0 with existing warnings.
• git ls-files --others --exclude-standard returned empty in the rehearsal clone.
• Environment: Darwin 25.5.0 arm64, rustc 1.95.0, cargo 1.95.0.

Code/acceptance inspection:

• /api/admin/serve/logs is wired in crates/octos-cli/src/api/router.rs under admin_api; when auth is configured, admin_api is wrapped by admin_auth_middleware.
• serve_logs returns an SSE stream with bounded replay, tail_n, case-insensitive whole-line grep, RFC3339 since, polling live tail, log rotation path refresh, and line redaction for bearer/query-token/API-key patterns.
• Docs now include the daemon-log curl shape in both English and Chinese user guides.

Current-main blocker found:

• Full cargo fmt --all -- --check fails outside this PR diff on current-main formatting drift in:
  • crates/octos-agent/src/agent/loop_runner.rs
  • crates/octos-agent/src/loop_detect.rs
  • crates/octos-cli/src/api/ui_protocol_ledger.rs
• The touched Rust files for this PR passed formatting.

Remaining gap:

• GitHub reports this PR as MERGEABLE but REVIEW_REQUIRED / BLOCKED, so I did not merge.