feat: harden support, localize knowledge and add operator availability [skip ci]

Source-only publication of reviewed commit 64e96a7f423673dc29ad56485be9fc79bce8af1c.

Passed in isolation: focused frontend/backend tests, race checks, TypeScript typecheck, lint, Go compilation, Flowgram build, and deterministic SDK build/tests.

Not accepted as a production release: Next.js export/native assembly remains blocked by environment memory limits; browser interaction and MySQL staging acceptance remain unverified. No production server, database/schema, runtime configuration, deployment, release tag, or workflow execution was performed.

Expected source tree: 0a4a7528e9.

web/lib/realtime-log-context.test.mjs

@@ -0,0 +1,11 @@
+import assert from "node:assert/strict"
+import test from "node:test"
+import { realtimeLogContext } from "./realtime-log-context.ts"
+
+test("socket diagnostics contain only origin and path, never URL credentials or query", () => {
+  assert.deepEqual(realtimeLogContext("wss://user:password@example.test/api/ws/admin?accessToken=not-a-secret#fragment"), {
+    origin: "wss://example.test",
+    path: "/api/ws/admin",
+  })
+  assert.deepEqual(realtimeLogContext("invalid token-bearing input"), { origin: "", path: "" })
+})