docs(swarm): document the log store

VictoriaLogs shipped without an operator-facing section: services.md
covered SSO, metrics and the collector, and said nothing about where the
swarm's logs land, how to read them, or how long they are kept.

Adds one, answering the questions an operator arrives with — the name it
serves on, that Grafana's Explore is the browser for it, retention, and
that it binds loopback with the gateway vhost as the only way in.

docs/swarm/services.md

@@ -99,6 +99,29 @@ Neither container is reachable except through the gateway: both bind
 loopback, and VictoriaMetrics' write endpoint takes no credential, so
 the collector is the only intended writer.
 
+### Logs (VictoriaLogs)
+
+The swarm's service containers ship their journals to one VictoriaLogs at
+`logs.<swarm-domain>`, behind the same SSO as everything else. It follows
+`swarm.enableRequiredServices` too, and the collector below is what writes
+to it.
+
+**Reading them.** Open Grafana, pick **Explore**, and choose the
+`VictoriaLogs` datasource — it is provisioned for you. Grafana's *Logs
+Drilldown* app is deliberately not installed: it only supports Loki, and
+no setting here changes that, so Explore is the log browser for this
+swarm.
+
+| Option | When you'd touch it |
+|---|---|
+| `swarm.victorialogs.retentionPeriod` | Default `30d`, far shorter than the metrics store's — logs are bulkier per unit of value and are usually read within days of being written. Raise it if you need to answer questions about last quarter. |
+| `swarm.victorialogs.domain` | Only to rename it. |
+| `swarm.victorialogs.port` | Only if something else on the services host already claims `9428`. |
+
+Like the metrics store, it binds loopback and takes no credential of its
+own: the gateway vhost is the only way in, and the collector is the only
+intended writer.
+
 ### Telemetry collector (OTEL)
 
 The swarm's collector receives from every hive's own collector and is the