Add owner-only logging and Brickset API call tracking

LIM configured no logging at all, so the instruction fetcher had no trail to follow. Adds a rotating file handler on the root logger plus two owner-only admin pages.

- Admin > Logs: filter by level, source and text; tracebacks kept with their error; auto-refresh, raw download, rotated-file browsing and rotate-now

- Admin > Logs > Brickset API calls: every outbound call recorded with method, params, caller, duration, result count and error, plus daily quota accounting (only getSets counts) and a comparison against getKeyUsageStats

- New owner concept (services/ownership.py): a single account, distinct from is_admin, since these pages expose other admins activity. Defaults to the first admin; flask owner show/set to change

- Services now log through module loggers; retention setting and pruning for call records

- New CLI: flask owner show/set, flask logs path/prune

- New table brickset_api_calls, created automatically at boot; LOG_* env vars, /data/logs in Docker

app/config.py

@@ -59,6 +59,17 @@ class Config:
     # stream straight to disk and never go through Flask's form parser.
     BACKUP_MAX_UPLOAD = int(os.environ.get('BACKUP_MAX_UPLOAD', 0))
 
+    # Logging
+    # Rotating file handler; the admin log viewer reads these files.
+    # Docker points LOG_FOLDER at the mounted volume (/data/logs).
+    LOG_FOLDER = _resolve_path(os.environ.get('LOG_FOLDER'),
+                               os.path.join(projectdir, 'logs'))
+    LOG_LEVEL = os.environ.get('LOG_LEVEL', 'INFO')
+    LOG_MAX_BYTES = int(os.environ.get('LOG_MAX_BYTES', 2097152))  # 2MB
+    LOG_BACKUP_COUNT = int(os.environ.get('LOG_BACKUP_COUNT', 5))
+    # Per-request access logging is noisy; off unless you ask for it.
+    LOG_ACCESS = os.environ.get('LOG_ACCESS', '0') == '1'
+
     # Automatic instruction fetcher
     # Pacing (interval, delays, on/off) lives in site_settings so it can be
     # changed from the admin page. These are the hard limits and the switch