v0.1.5 Log sources

Radar only, as before: nothing is blocked, challenged or rate-limited.

Added

• Log sources. Traffic that never reaches WordPress can be read from the web server's access log (combined format), such as another application on the same server or requests nginx answers from its page cache or refuses at a gate. Each source keeps its own minute rows, learned baseline, storm state and transitions. They are defined and run from WP-CLI only: wp bot-storm-radar source add|list|remove, ingest (once a minute from a system timer) and replay (test detection against past logs). Profiles are mediawiki and wordpress. See #2.
• Alerts per source. They name the source, link to its radar and go to its own recipients (--alert-to) or the site's. A log source starts mailing once its baseline holds one full day.
• Radar tab per source. A source switcher, each source's own cards, chart, top keys and timeline, and a log reader card. The dashboard widget lists log sources, and the Settings tab lists them read-only.

Fixed

• A storm held up by error pressure alone no longer leaves and re-enters the storm state every 15 minutes with an alert each time (#1).

Existing installs keep all their data; the site's option names are unchanged.