feat(quaykeeper): split log destinations into reusable endpoints

[kalevski]

Rework the monolithic log-destination model (logs_feature.md) — the nginxpilot and client-go wire contract is unchanged; only quaykeeper's storage, services, routes, and UI change:

• domain: extract shared endpoint/tunables validation; add DestinationEndpoint, LogShaping, parseShaping, and assembleSpec(dest, binding), which reassembles the two halves into the existing LogDestination wire shape
• data: new log_binding table (UNIQUE(scope, target, destination_id)); log_destination repurposed as an endpoint-only registry (loki/http, no scope/target/shaping); new log-binding-repo + ID.logBinding
• services: new log-bindings service owns daemon push/retract — realm bindings push to their own realm's client (never the active-realm cookie) with rollback on daemon reject; instance bindings are snapshot-delivered; per-realm reconcileRealm replaces the global reconcile; endpoint update re-pushes bound realms; delete blocked with 409 while bound; realm delete cascade-drops its bindings
• api: realm binding routes (owner) + instance logs routes (maintainer, D3); status route accepts ?realm= for per-daemon stats
• ui: endpoint-only /admin/log-destinations with "Used by" counts; RealmLogDestModal + logs badge on the Servers page; new Logs tab under /instances/[id] with shared shaping form; "Variables" section renamed to "Instances"
• db: squash migrations v1–v21 into a single v1 creating the final schema (fresh-database semantics; deprecated log_destination scope/target/enabled columns dropped outright); migration runner now accepts function entries for future TS backfills

Summary

Affected packages

• @toolcase/base
• @toolcase/logging
• @toolcase/serializer
• @toolcase/node
• @toolcase/web-components
• @toolcase/phaser-plus
• examples/ site
• Repo / CI / tooling

Change type

• Bug fix (non-breaking)
• New feature (non-breaking, additive)
• Breaking change (API removal, behavior change)
• Refactor / internal cleanup
• Docs / SKILL.md / examples
• Build / CI / tooling

Test plan

• npm run lint
• npm test
• npm run build
• npm run lint:exports (when public surface changes)
• Manual check in examples/ (when UI changes)

Checklist

• PR is focused on a single logical change
• Public API changes are reflected in the relevant examples/public/<pkg>/SKILL.md
• New component / export is added to its package's src/index.ts
• No border-radius introduced in web-components (except sanctioned circles/pills)
• New web-components entries register their tag in src/register.ts and clean up listeners/observers in disconnectedCallback

Related issues