[AmrMsCLL]

Phase 8 of the hub server plan: the README describes the console as it runs after #19 to #30.

Changes

• Pages: Logs, Secrets and Backups; the Project page's Redeploy, release control and secrets section; the Overview's needs-redeploy hint and last backup run.
• Access: secrets:<slug> is its own grant and * does not include it (access.ts); owners alone see Admin, Secrets and Backups.
• Stack: the secret store (secrets.ts: AES-256-GCM, versions, audit, host writer, rotation and reconcile on start), backups through .requests/ under /var/lib/graphite/backups (backups.ts), the hub metrics check (hub.ts), the log store in the logs volume (logstore.ts).
• Production: compose.yaml and values instead of values.yaml; the env file is /etc/graphite/console.env placed by hand, not the secrets repository; every variable from config.ts with its default.
• Alerts: the rule list from alerts.ts, editable thresholds, email on alert and resolution, the test send.
• API table from main.ts, including secrets, backups, releases, rules, volumes and logs.

No code changes.