feat(api): admin-only scrubbed diagnostics bundle (server side of #180)

[badbread]

The server-side piece of #180: an admin-only, downloadable, scrubbed diagnostics bundle so a maintainer can triage a tester's server-side issue without shell access. (The desktop client already shipped its half in #274.)

What it adds

• GET /diagnostics/bundle (AdminUser-gated → 403 otherwise): a pretty-JSON snapshot delivered as a file attachment (crumb-diagnostics-<ts>.json), containing:
  • version (service / version / git sha / build time)
  • effective server settings (the DB server_settings row)
  • a curated, non-secret env whitelist (LOG_FORMAT, TZ, MOTION_HWACCEL, ...)
  • applied schema migrations (count + latest few) — tells whether the DB is at the expected version
• A "Diagnostics — support bundle" download button in the admin console's server-settings panel.

Secure by default (load-bearing)

Everything is run through a recursive redact() pass before it leaves the box:

• any value under a secret-shaped key (token / password / secret / hash / api_key / credential / private / ...) → "***REDACTED***"
• any string carrying URL userinfo (scheme://user:pass@host) → scheme://***@host (dependency-free, no regex crate)

Two independent nets, so a leak would need both a surprising field name and a non-URL secret shape. env is a whitelist, never std::env::vars(). Footage and live logs are never included.

Deliberately out of scope (follow-up on #180)

Live logs and runtime health. Logs are stdout-only, so shipping them needs an in-process ring buffer, and the recorder's logs live in a separate process — a bigger piece. The config + schema snapshot already covers a large class of "why isn't X working" server-side.

Tests

• redact() unit tests: secret-shaped keys anywhere in the tree, credential-URL masking (with documentation-range IPs), and a URL under a non-secret key.
• Route test: admin → 200 + attachment; authenticated viewer → 403.
• fmt + clippy -D warnings + full cargo test --workspace all green; admin.html script passes node --check.

Addresses #180 (server bundle piece).

🤖 Generated with Claude Code