feat: Log Insights panel — plain English activity summary + safe log disposal

- New route /api/v1/log-insights: analyzes audit logs + security events
  - Shows top IPs with request counts, failures, and top actions
  - Plain English insights (heavy users, auth failures, security alerts)
  - Summary stats: total requests, unique IPs, failed actions
  - Storage info showing log file sizes and entry counts
- New route POST /api/v1/log-insights/dispose: preview-then-confirm cleanup
  - First call shows what would be deleted (preview mode)
  - Second call with confirm:true actually deletes
  - Configurable retention period (default 30 days)
- Frontend panel with modal UI showing insights as cards
  - Period selector (1h, 6h, 24h, 7d)
  - Top visitors table with IP, requests, failures, actions, last seen
  - Storage info footer
  - Clean Old Logs button with preview confirmation dialog
- Wired into app.js and dashboard navbar (🔍 Insights button)
- Addresses QA issue: users need to see who is accessing before cleanup

status/index.html

@@ -206,6 +206,7 @@
             <button id="manage-notifications" aria-label="Manage notifications">🔔 Alerts</button>
             <button id="audit-log-btn" aria-label="Audit log">📜 Audit</button>
             <button id="security-center-btn" aria-label="Security Center">🛡️ Security</button>
+            <button id="log-insights-btn" aria-label="Log Insights">🔍 Insights</button>
             <button id="docker-resources-btn" aria-label="Docker resources">🐳 Docker</button>
           </div>
         </div>
@@ -950,6 +951,7 @@
   <script src="/js/xterm-fit.min.js" defer></script>
 
   <!-- Tailscale device list panel (self-contained, polls /api/v1/tailscale/devices) -->
+  <script src="/js/log-insights.js" defer></script>
   <script src="/js/tailscale-devices.js" defer></script>
 
   <!-- Bundled JS (built with: npm run build) -->