feat: diagnostic log (tracing)

The app now writes a diagnostic log to nexus.log in the data directory
(0600, rotated at 5 MiB): connection attempts and results, remote
closes, reconnect scheduling, host-key/certificate checks with the
policy applied, and credentials that couldn't be stored (kind only).
Credentials and terminal data are never logged. RUST_LOG sets the level
and also mirrors the log to stderr. The remaining eprintln! diagnostics
in storage and URL handling go through it too.

rust/core/src/sessions/credentials.rs

@@ -149,6 +149,7 @@ impl Manager {
                     Err(_) => Err("host key prompt failed: host key prompt timed out waiting for user response".into()),
                 }
             };
+            tracing::info!(host = %k.host, port = k.port, key_type = %k.key_type, fingerprint = %k.fingerprint, ?policy, known = stored.is_some(), "checking host key");
             match (policy, stored) {
                 (HostKeyPolicy::Insecure, None) | (HostKeyPolicy::AcceptNew, None) => save(),
                 (HostKeyPolicy::Insecure, Some(s)) => touch(s),