Camera permission and review fixes (openpanel C3, C4)

C4: a device's `viewers` (superusers by default, or members) covers the
image and video messages its ports publish. Anyone else gets none of their
values on the socket, in the catalogue or a flow's state, 403 for their
history, for the frames they hold (the last 8 included) and for TURN
credentials, no bytes when asking for them, and `bye: forbidden` for a live
view. A device credential stays bounded by its dashboards. The device page
sets it in its Camera section, and a tile the viewer may not see says
"No access to this camera" and asks the camera for nothing.

C3:
- A volatile upload is held to MAX_FRAME_BYTES (4 MiB, 413 above it, read
  without extra copies), and so is a frame on a device's socket.
- A frame the engine holds in memory is written to the ring directory
  before a local worker is handed it, so load_artifact finds it.
- A socket the bus dropped events for catches up with a snapshot, demand
  included, and a device's credential is checked again per frame, cached by
  the flow store revision and its nonce, so a lost event never keeps an
  unpaired device's frames coming.
- A report is at most 64 KB once its named config_schemas are put in place.
- A device away for 60 s has its true bool messages set to false.
- Refused frames are logged by fixed keys, a frame is named after its
  message, `fluksio serve` waits 5 s for open connections, a tile with a
  stream URL creates no demand, the 8-name cap keeps the newest names.
- Every container's log rotates (json-file, 3 x 10 MB).

docker/compose.dev.yml

@@ -2,12 +2,21 @@
 # published host ports, hot reload and the mail/browser test helpers.
 # Never used in production — the Makefile only layers it for `make dev*`.
 
+# Every container's log rotates: json-file, at most 3 files of 10 MB each.
+# Docker's default keeps one file that grows until the host's disk is full.
+x-logging: &logging
+  driver: json-file
+  options:
+    max-size: "10m"
+    max-file: "3"
+
 services:
 
   # Local Traefik. Services stay reachable both on their published ports and
   # on http://api.localhost / http://app.localhost via the routers in
   # compose.yml. Dashboard at http://localhost:8090.
   proxy:
+    logging: *logging
     # A patch tag, so a host holding an older cached 3.6 pulls this one. 3.6.25
     # knows --accesslog.fields.queryparameters, which older 3.6 refuses.
     image: traefik:3.6.25
@@ -61,6 +70,7 @@ services:
   # them, and 1883 in particular tends to be taken by the real broker on a
   # machine that runs this alongside anything else.
   mosquitto:
+    logging: *logging
     image: eclipse-mosquitto:2
     restart: "no"
     # The config the image ships for exactly this: listener on 1883, anonymous
@@ -68,6 +78,7 @@ services:
     command: mosquitto -c /mosquitto-no-auth.conf
 
   influxdb:
+    logging: *logging
     image: influxdb:2.7
     restart: "no"
     # Dev credentials, and no volume: the container comes up initialised and a
@@ -151,6 +162,7 @@ services:
       API_DOCS_ENABLED: "true"
 
   mailcatcher:
+    logging: *logging
     image: schickling/mailcatcher
     ports:
       - "1080:1080"
@@ -162,6 +174,7 @@ services:
     restart: "no"
 
   playwright:
+    logging: *logging
     build:
       context: ..
       dockerfile: frontend/Dockerfile.playwright