dashboard: add GET /api/build-logs/{agent} + /id/{id} endpoints (#726 phase 2)

Wires the Phase 1 sqlite store into the dashboard HTTP layer so the
frontend can surface full build logs without hitting journald.

Two new read endpoints:
- GET /api/build-logs/{agent}?limit=N  — Vec<BuildLogHeader> JSON,
  newest first, default limit 10, server-side cap at 50.
- GET /api/build-logs/id/{id}          — BuildLogFull JSON (header +
  stdout + stderr), HTTP 404 on vacuum-reaped / unknown ids.

Agent-name validated ([a-z0-9_-], 1-63 chars) before the sqlite call.
Both handlers reach coord.build_logs (Arc<BuildLogs>) introduced in
the Phase 1 commit. Docs updated in docs/web-ui.md.

docs/web-ui.md

@@ -836,6 +836,16 @@ that's a browser-level decision, not ours.
   `Sent` event re-renders both the message-flow terminal and
   the operator inbox without a snapshot refetch. Used by the
   compose textbox under MESS4GE FL0W.
+- `GET /api/build-logs/{agent}?limit=N` — most-recent build log
+  headers for one agent, newest first. Returns
+  `Vec<BuildLogHeader>` (JSON): `id`, `agent`, `kind`, `cmdline`,
+  `started_at`, `finished_at`, `status` (`"ok"` / `"fail"` /
+  `null` while in-progress). `limit` defaults to 10, server-side
+  cap at 50. Agent name validated (`[a-z0-9_-]`, 1-63 chars).
+- `GET /api/build-logs/id/{id}` — full build log by id. Returns
+  `BuildLogFull` (JSON): all header fields plus `stdout` and
+  `stderr` as plain text (newline-terminated lines, utf-8). HTTP
+  404 when the row is missing (vacuum-reaped or stale id).
 - `GET /api/journal/{name}?unit=&lines=` — journalctl viewer for
   a managed container; rendered in the side panel.
 - `GET /api/approval-diff/{id}?base=applied|approved|previous` —