feat: persist execution logs + dashboard detail view + integration tests

Three threads landing together because they share a public surface
(the new execution_log shape) and verifying any one in isolation
would mean re-doing the work later.

== (A) execution log persistence ==

  * shared::ExecutionLog + ExecutionStatus carry the audit-trail
    shape that flows from the orchestrator through the sink and
    back out via the manager's logs endpoint.

  * shared::ExecutionLogSink trait — abstraction the orchestrator
    writes through. In single-process MVP mode the manager's
    Postgres-backed impl is plugged in directly; in cluster mode
    (v1.3+) the orchestrator's impl will post over HTTP to the
    manager. Trait lives in `shared` so neither *-core crate has
    to know about the other.

  * manager-core::PostgresExecutionLogSink writes to the
    execution_logs table (already in the initial migration);
    PostgresExecutionLogRepository reads them back, paginated.
    AdminState now carries both a script repo and a log repo, so
    `admin_router` exposes `GET /scripts/{id}/logs?limit=&offset=`
    capped at 200 rows per page to keep the dashboard responsive.

  * orchestrator-core::DataPlaneState gains `log_sink`. The
    execute handler builds an ExecutionLog on every outcome —
    success, error, timeout, budget-exceeded — and awaits the
    sink. Sink failures are logged at warn and DO NOT mask the
    user-facing result, since "we couldn't write the audit row"
    is a separate concern from "the script ran".

  * picloud binary refactored into a lib (`build_app(pool)` is
    the seam) + thin bin shell. Same Postgres pool backs the
    script repo, the log repo, and the sink — no double pool.

== (B) dashboard ==

  * Typed API client extended with `scripts.logs(id, opts)`,
    `scripts.update/remove`, and `execute(id, body, headers)`.
    Plain `fetch` wrapper now surfaces server-side error
    messages via a typed ApiError so the UI can render them.

  * `/` — create-script form now actually creates; on success
    the list reloads. List entries link to detail.

  * `/scripts/[id]` — new detail route: source editor with save
    (calls update, version bumps); Test invoke panel that sends
    arbitrary JSON body + headers to /api/execute and shows the
    response; Recent executions panel reading from /logs with
    expandable per-row request/response/script-log views.
    Delete button with confirm. SPA-routed; Caddy serves
    `build/` with the same index.html fallback.

== (C) integration tests ==

  * crates/picloud/tests/api.rs — 14 sqlx::test cases driving
    `build_app` through an axum_test::TestServer against a fresh
    Postgres DB per test. Covers: health, full script CRUD,
    duplicate-name conflict, invalid-source rejection on both
    create and update, execute echoing the body, status+header
    passthrough, 404 on missing scripts, error-path executions
    landing in the audit log with the right status.

  * Tests are `#[ignore]` by default so plain `cargo test
    --workspace` stays green without infrastructure. Opt-in via:
    `docker compose up -d postgres && \
       DATABASE_URL=postgres://picloud:picloud@127.0.0.1:15432/picloud \
       cargo test -p picloud --test api -- --include-ignored`

Verified live through Caddy on :8000: three logged invocations
land in the logs endpoint with the right structured `data` on
each `log::info`/`log::warn`, error-path executions are still
captured with status=error, dashboard list + SPA detail route
both reachable.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/manager-core/src/log_sink.rs

@@ -0,0 +1,57 @@
+use async_trait::async_trait;
+use picloud_shared::{ExecutionLog, ExecutionLogSink, LogSinkError};
+use sqlx::PgPool;
+
+/// Persists `ExecutionLog` rows to the `execution_logs` table.
+///
+/// In cluster mode this impl lives in the manager and is reachable
+/// from orchestrator nodes via an HTTP wrapper; in single-process MVP
+/// mode the orchestrator's `DataPlaneState` holds it directly.
+pub struct PostgresExecutionLogSink {
+    pool: PgPool,
+}
+
+impl PostgresExecutionLogSink {
+    #[must_use]
+    pub fn new(pool: PgPool) -> Self {
+        Self { pool }
+    }
+}
+
+#[async_trait]
+impl ExecutionLogSink for PostgresExecutionLogSink {
+    async fn record(&self, log: ExecutionLog) -> Result<(), LogSinkError> {
+        let headers = serde_json::to_value(&log.request_headers)
+            .map_err(|e| LogSinkError::Backend(format!("encode headers: {e}")))?;
+        let response_code = log.response_code.map(i32::from);
+        let duration_ms = i32::try_from(log.duration_ms).unwrap_or(i32::MAX);
+
+        sqlx::query(
+            "INSERT INTO execution_logs ( \
+                id, script_id, request_id, \
+                request_path, request_headers, request_body, \
+                response_code, response_body, \
+                logs, duration_ms, status, created_at \
+             ) VALUES ( \
+                $1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12 \
+             )",
+        )
+        .bind(log.id)
+        .bind(log.script_id.into_inner())
+        .bind(log.request_id.into_inner())
+        .bind(&log.request_path)
+        .bind(headers)
+        .bind(&log.request_body)
+        .bind(response_code)
+        .bind(&log.response_body)
+        .bind(&log.script_logs)
+        .bind(duration_ms)
+        .bind(log.status.as_str())
+        .bind(log.created_at)
+        .execute(&self.pool)
+        .await
+        .map_err(|e| LogSinkError::Backend(e.to_string()))?;
+
+        Ok(())
+    }
+}