Add owner-only logging and Brickset API call tracking

LIM configured no logging at all, so the instruction fetcher had no trail to follow. Adds a rotating file handler on the root logger plus two owner-only admin pages.

- Admin > Logs: filter by level, source and text; tracebacks kept with their error; auto-refresh, raw download, rotated-file browsing and rotate-now

- Admin > Logs > Brickset API calls: every outbound call recorded with method, params, caller, duration, result count and error, plus daily quota accounting (only getSets counts) and a comparison against getKeyUsageStats

- New owner concept (services/ownership.py): a single account, distinct from is_admin, since these pages expose other admins activity. Defaults to the first admin; flask owner show/set to change

- Services now log through module loggers; retention setting and pruning for call records

- New CLI: flask owner show/set, flask logs path/prune

- New table brickset_api_calls, created automatically at boot; LOG_* env vars, /data/logs in Docker

.env.example

@@ -38,3 +38,13 @@ INSTRUCTION_FETCH_TICK_SECONDS=20
 # Largest instruction PDF to accept, in megabytes.
 FETCH_MAX_FILE_MB=150
 FETCH_TIMEOUT_SECONDS=60
+
+# --- logging ----------------------------------------------------------------
+# The admin log viewer (owner only) reads these files.
+LOG_FOLDER=logs
+LOG_LEVEL=INFO
+# Rotate at this size, keeping LOG_BACKUP_COUNT old copies.
+LOG_MAX_BYTES=2097152
+LOG_BACKUP_COUNT=5
+# 1 to include per-request access logging (noisy).
+LOG_ACCESS=0