Add owner-only logging and Brickset API call tracking

LIM configured no logging at all, so the instruction fetcher had no trail to follow. Adds a rotating file handler on the root logger plus two owner-only admin pages.

- Admin > Logs: filter by level, source and text; tracebacks kept with their error; auto-refresh, raw download, rotated-file browsing and rotate-now

- Admin > Logs > Brickset API calls: every outbound call recorded with method, params, caller, duration, result count and error, plus daily quota accounting (only getSets counts) and a comparison against getKeyUsageStats

- New owner concept (services/ownership.py): a single account, distinct from is_admin, since these pages expose other admins activity. Defaults to the first admin; flask owner show/set to change

- Services now log through module loggers; retention setting and pruning for call records

- New CLI: flask owner show/set, flask logs path/prune

- New table brickset_api_calls, created automatically at boot; LOG_* env vars, /data/logs in Docker

docker-compose.yml

@@ -54,6 +54,11 @@ services:
       # Automatic instruction fetcher. Safe to leave on: gunicorn runs a
       # single worker here, so there is exactly one ticker, and it does
       # nothing until an admin enables it in the UI.
+      LOG_FOLDER: /data/logs
+      LOG_LEVEL: ${LOG_LEVEL:-INFO}
+      LOG_MAX_BYTES: ${LOG_MAX_BYTES:-2097152}
+      LOG_BACKUP_COUNT: ${LOG_BACKUP_COUNT:-5}
+      LOG_ACCESS: ${LOG_ACCESS:-0}
       INSTRUCTION_FETCH_WORKER: ${INSTRUCTION_FETCH_WORKER:-1}
       INSTRUCTION_FETCH_TICK_SECONDS: ${INSTRUCTION_FETCH_TICK_SECONDS:-20}
       FETCH_MAX_FILE_MB: ${FETCH_MAX_FILE_MB:-150}