dashboard: remove the L0GS page and its journal backend

Logs live at swarm level now (VictoriaLogs, read through Grafana
Explore). The hive dashboard's own journal viewer goes, with
everything that existed only to serve it:

- frontend: /logs.html, logs.js, logs.css, the H0M3 "Logs" tile and
  the per-agent menu's "journal logs ->" link. The build-log list
  rules BU1LDS used from logs.css move into builds.css.
- hive-c0re: GET /api/journal/{name} and GET /api/journal-host, and
  priv_client::read_container_journal.
- hive-priv / hive-priv-sock: the ReadContainerJournal request, its
  JournalQuery/JournalOutput wire types and the journalctl -M executor.
- nix: hive-c0re's systemd-journal supplementary group, whose only
  reader was the journal-host handler.
- docs: the L0GS section, the API entry and the security table row.

Closes #5113
Closes #3819

docs/web-ui/dashboard.md

@@ -12,7 +12,7 @@ hive-c0re serves the dashboard at `/dashboard.html` (with the home page at `/`).
 It has a fixed chrome header at the top and a `<main>` that shows exactly
 one tab pane at a time. The URL hash (`#swarm`, `#call`,
 `#permissions`, `#schedules`) drives which pane is
-active; hash changes don't reload the page. FL0W, L0GS, and the other
+active; hash changes don't reload the page. FL0W and the other
 standalone pages are reachable from the H0M3 hub at `/`, not
 from the dashboard tab strip.
 
@@ -21,7 +21,7 @@ from the dashboard tab strip.
   at `/`. Every surface links back to the hub rather than to each other.
 - **Tab strip**: `◆ SW4RM ◆`, `◆ Y3R C4LL ◆`, `◆ P3RM1SS10NS ◆`,
   `◆ SCH3DUL3S ◆`. In-page tabs only — the SYST3M panels live on the
-  standalone **C0R3** page (`/core.html`), and FL0W / L0GS / ST4TS
+  standalone **C0R3** page (`/core.html`), and FL0W / ST4TS
   live on their own pages too, all reachable from the
   H0M3 hub (not the tab strip). Count pills on SW4RM
   (container count), Y3R C4LL (unread
@@ -29,7 +29,7 @@ from the dashboard tab strip.
 - **Banner-thin** (`░▒▓█▓▒░ HYPERHIVE / HIVE-C0RE / WE ARE THE WIRED ░▒▓█▓▒░`)
   — sits below the tab strip.
 - **Server-warnings banner** — a generic, sticky top-of-page strip shown
-  on **every** page (dashboard + every stand-alone page — FL0W, L0GS,
+  on **every** page (dashboard + every stand-alone page — FL0W,
   H0M3, C0R3, BU1LDS, ST4TS), injected at the top
   of `<body>` by `renderServerWarnings` in `common.js`. Driven by
   `state.server_warnings` — a list of `{ kind, level, message }` — and
@@ -53,9 +53,9 @@ from the dashboard tab strip.
   cold-load and updates it live as broker `sent` events arrive; it's
   preserved when `hive_name` / `swarm_name` later replace the raw title.
 
-The FL0W and L0GS pages use a slim header (a `← home` back-link + the
-page title) rather than the dashboard tab strip — they're standalone
-surfaces, not tab panes.
+The FL0W page uses a slim header (a `← home` back-link + the page
+title) rather than the dashboard tab strip — it's a standalone surface,
+not a tab pane.
 
 ## SW4RM tab
 
@@ -110,7 +110,7 @@ instead — it's agent-terminal-only, unrelated to this section.
 
 Passive / rare-interaction state, reached from the **Core** tile on the
 H0M3 hub (served at
-`/core.html`), with the same minimal chrome as `/logs.html`: a `← home`
+`/core.html`), with the same minimal chrome as `/builds.html`: a `← home`
 back-link + a `createTabStrip` sub-tab nav (**K3PT ST4T3** default,
 then **C0NT41N3R L04D**). The page is its own esbuild bundle (`core.js`)
 that cold-loads `/api/state` and subscribes to `/api/dashboard/stream` for
@@ -400,7 +400,7 @@ tab activation and on each dashboard state load.
 Hive-wide turn statistics, aggregated across every agent's
 `hyperhive-turn-stats.sqlite` for the selected window. Not a dashboard
 tab — a standalone page reached from the **Stats** tile on the H0M3
-hub, same minimal chrome as `/flow.html` / `/logs.html`. Distinct from
+hub, same minimal chrome as `/flow.html`. Distinct from
 each agent's own `/stats` page (which carries the per-agent trend
 charts): ST4TS is the swarm-level rollup.
 
@@ -488,7 +488,7 @@ re-renders the terminal row. The operator addresses the root agent as `@root`.
 ## H0M3 page (`/`)
 
 The H0M3 hub is the primary landing page (served at `/` by default). A
-responsive grid of link tiles — Dashboard, Flow, Logs, Builds, Stats,
+responsive grid of link tiles — Dashboard, Flow, Builds, Stats,
 Core, API — each pointing to their respective
 surfaces, all unconditionally shown (no gating). The page is a pure
 portal with no tab-bar or SSE subscriptions. Typography + colours inherit
@@ -496,45 +496,6 @@ from the shared theme (Catppuccin Mocha via `common.css` + `theme.css`).
 `home.js` fills the swarm/hive identity line at the top. All dashboard
 sub-pages include a `← Home` back-link for navigation.
 
-## L0GS page (`/logs.html`)
-
-A dedicated log-viewer page (not a tab pane — a separate HTML page),
-reachable from the Logs tile on the H0M3 hub. Minimal chrome:
-a `← home` back link and a three-item sub-tab strip. Tab
-routing is hash-based (`#agent`, `#infra`, `#system`); default is
-`#agent`. (Build log history lives on the BU1LDS page — see above.)
-
-**AGENT sub-tab** — per-container journald viewer. Two selects: agent
-name (populated from `GET /api/state`) and unit filter
-(`hive-agent.service` / `hive-mcp-http.service` /
-`hive-bash-daemon.service` / `hive-matrix-daemon.service` /
-`(full machine journal)`). Fetches
-`GET /api/journal/{name}?unit=<unit>&lines=500` on selection change
-or `↻ refresh`. Output rendered as a `<pre>` block. A `?agent=<name>`
-and/or `?unit=<svc>` URL param pre-selects the agent + unit on page
-load — the per-agent `⋮` menu's **journal logs →** entry uses this to
-deep-link directly to a specific agent's journal. A "fetched N ago"
-chip appears after the `↻ refresh` button following each successful
-fetch and ticks every 30 s.
-
-**INFRA sub-tab** — journald viewer for the three hive infrastructure
-containers (`hive-forge`, `hive-gateway`, `hive-matrix`), a
-fixed client-side list (`INFRA_NAMES` in `logs.js` — no dashboard API
-exposes just the name list). No unit filter (infra containers don't run
-the per-agent hive daemons) — always the full machine journal (or, for
-the gateway, the host journal filtered to its own unit). Fetches
-`GET /api/journal/{name}?lines=500`, same "fetched N ago" ticker as
-AGENT. A `?agent=<name>` deep-link routes here instead of AGENT when
-the name is one of the three infra containers.
-
-**SYSTEM sub-tab** — host-side service logs. Unit selector
-(`hive-c0re.service` / `hive-priv.service`). Fetches
-`GET /api/journal-host?unit=<unit>&lines=500` on activation
-and on `↻ refresh`. Rendered as a `<pre>` block. A "fetched N ago"
-chip ticks every 30 s. Available to the operator unconditionally (not
-capability-gated — the endpoint lives on the hive-c0re dashboard,
-behind the gateway).
-
 ## Container row
 
 A full-height **square agent icon** (5em, capped) on the left. The
@@ -700,9 +661,6 @@ per-agent actions and navigation links. Contents:
   Identical to the bulk actions on the selection bar but operate
   on one agent without requiring a selection.
 - `↻ R3BU1LD` — always available; queues a rebuild for this agent.
-- `journal logs →` — opens `/logs.html#agent?agent=<name>` so the
-  operator lands directly in the AGENT log tab pre-filtered to this
-  container, without having to pick an agent from the dropdown.
 - `DESTR0Y` / `PURG3` — destructive, each prompts for confirmation
   via the themed dialog (see **Themed dialogs** below).
 - `deployed:<sha> ↗` — present when the agent has a `deployed_sha`
@@ -884,8 +842,6 @@ below — some endpoints aren't in it yet.
   stdout+stderr as `text/plain`. Used by the `↓ raw` / `↓ download
   raw` links in BU1LDS. Works on both finished and in-progress
   build logs.
-- `GET /api/journal/{name}?unit=&lines=` — journalctl viewer for
-  a managed container; rendered in the side panel.
 - `GET /static/marked.js` serves the vendored `marked` bundle used
   for markdown previews.
 - `GET /api/state-file?path=<host-or-container-path>` — bounded