feat: diagnostic log (tracing)

The app now writes a diagnostic log to nexus.log in the data directory
(0600, rotated at 5 MiB): connection attempts and results, remote
closes, reconnect scheduling, host-key/certificate checks with the
policy applied, and credentials that couldn't be stored (kind only).
Credentials and terminal data are never logged. RUST_LOG sets the level
and also mirrors the log to stderr. The remaining eprintln! diagnostics
in storage and URL handling go through it too.

rust/app/Cargo.toml

@@ -14,6 +14,8 @@ eframe = { version = "0.36", default-features = false, features = ["default_font
 egui = "0.36"
 parking_lot = "0.12"
 zeroize = "1"
+tracing = "0.1"
+tracing-subscriber = { version = "0.3", default-features = false, features = ["fmt", "env-filter", "std", "ansi"] }
 egui-phosphor = "0.14"
 rfd = "0.17"
 image = { version = "0.25", default-features = false, features = ["png"] }