Add activity logs, sidebar badges, and logout with working alert colors.

Record auth audits and surface them in Activity, poll sidebar counts without resetting idle, and add a profile logout path plus theme red/green/blue tokens so failure badges render.

service/internal/api/authz.go

@@ -14,6 +14,7 @@ var errNodesDeleteRequired = errors.New("permission nodes.delete required")
 var errActionsCreateRequired = errors.New("permission actions.create required")
 var errActionsUpdateRequired = errors.New("permission actions.update required")
 var errActionsDeleteRequired = errors.New("permission actions.delete required")
+var errLogsReadRequired = errors.New("permission logs.read required")
 
 // permissionsForUser returns the union of permissions from the user's groups.
 func permissionsForUser(user settings.UserCredential, groups []settings.Group) map[string]struct{} {
@@ -100,6 +101,22 @@ func (app *App) authorizeNodesRead(request *http.Request) error {
 	return nil
 }
 
+func (app *App) authorizeLogsRead(request *http.Request) error {
+	user, ok := UserFromContext(request.Context())
+	if !ok {
+		return errors.New("authentication required")
+	}
+
+	payload, err := loadSettingsOrDefault(app.ConfigDir)
+	if err != nil {
+		return err
+	}
+	if !userHasPermission(user, payload.Groups, "logs.read") {
+		return errLogsReadRequired
+	}
+	return nil
+}
+
 func (app *App) authorizeNodesExec(request *http.Request) error {
 	user, ok := UserFromContext(request.Context())
 	if !ok {