Make the resolver pure DNS: JSON access log on stdout instead of a log store

The resolver kept its own query-log store (a bbolt ring, a live ring with SSE
fanout, rolling per-domain counters and dashboard time-series) for the console.
In a multi-node deployment each pod held a different slice of that, so every
view disagreed with itself, and the cost sat on the query path. Charts belong
in Grafana and log search in the log collector, so the store is gone.

internal/accesslog writes one JSON line per notable query to stdout. The default
is what was blocked and what failed (blocked, redirected, SERVFAIL, dropped,
refused); log_cached and sample_rate add ordinary answers for a debugging
session. Lines go through a bounded buffer to a single writer goroutine and are
dropped, and counted in fancydns_access_log_dropped_total, when the stream
cannot keep up, so a stalled log pipe can never stall a query. The config key is
access_log (the old qlog block is ignored, like any unknown key).

The metrics gain what the dashboard used to compute: fancydns_group_queries_total
by ACL group and outcome and fancydns_responses_total by RCODE. Removed with the
store: /api/dashboard, /api/logs, /api/logs/stream, /api/logs/clear,
/api/cache/top, the series rings, and the cache's per-name hit table, which took
a mutex and built a string on every cache hit.

Tests that read the old log now read the access-log lines; the contract test
drops the removed endpoints. The web console still calls them and is changed in
the next commit.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

internal/app/contract_test.go

@@ -122,25 +122,6 @@ func TestAdminEndpointKeySets(t *testing.T) {
 			wantKeys("components", "config", "started", "uptime_s", "version"))
 	})
 
-	t.Run("dashboard", func(t *testing.T) {
-		code, body := h.get("/api/dashboard?range=1h")
-		if code != http.StatusOK {
-			t.Fatalf("GET /api/dashboard = %d: %s", code, body)
-		}
-		requireKeys(t, "GET /api/dashboard", keysOf(t, body), wantKeys(
-			"blocked_pct", "blocked_total", "blocklist_rules", "cache_entries",
-			"cache_hit_rate", "config_version", "degraded_reason", "errors_total",
-			"generation", "health", "inflight", "listeners", "node_id",
-			"queries_per_sec", "queries_total", "recent", "series", "top_blocked",
-			"top_queried", "transports", "upstreams", "uptime_seconds", "version",
-		))
-		requireKeys(t, "GET /api/dashboard recent[0]", keysOfField(t, body, "recent", "0"), wantKeys(
-			"action", "blocked", "client", "client_group", "duration_ms", "id",
-			"list", "name", "protocol", "qtype", "qtype_name", "rcode", "rcode_name",
-			"response", "ts", "upstream",
-		))
-	})
-
 	t.Run("blocklists", func(t *testing.T) {
 		code, body := h.get("/api/blocklists")
 		if code != http.StatusOK {
@@ -210,23 +191,6 @@ func TestAdminEndpointKeySets(t *testing.T) {
 				"weight"))
 	})
 
-	t.Run("logs", func(t *testing.T) {
-		code, body := h.get("/api/logs?limit=10")
-		if code != http.StatusOK {
-			t.Fatalf("GET /api/logs = %d: %s", code, body)
-		}
-		requireKeys(t, "GET /api/logs", keysOf(t, body),
-			wantKeys("has_more", "items", "limit", "offset", "total"))
-		// Every key on every row. These were omitempty, so a row without an
-		// ACL group or a blocklist arrived without the key and the console
-		// rendered "undefined" instead of an empty cell.
-		requireKeys(t, "GET /api/logs items[0]", keysOfField(t, body, "items", "0"), wantKeys(
-			"action", "blocked", "client", "client_group", "duration_ms", "id",
-			"list", "name", "protocol", "qtype", "qtype_name", "rcode", "rcode_name",
-			"response", "ts", "upstream",
-		))
-	})
-
 	t.Run("cache", func(t *testing.T) {
 		code, body := h.get("/api/cache")
 		if code != http.StatusOK {
@@ -243,19 +207,6 @@ func TestAdminEndpointKeySets(t *testing.T) {
 		))
 	})
 
-	t.Run("cache top", func(t *testing.T) {
-		code, body := h.get("/api/cache/top?limit=5")
-		if code != http.StatusOK {
-			t.Fatalf("GET /api/cache/top = %d: %s", code, body)
-		}
-		requireKeys(t, "GET /api/cache/top", keysOf(t, body), wantKeys("items"))
-		// There is no `count` and no `last_seen`: the cache tracks a hit
-		// counter and a byte count per name, and the console's "Lookups" and
-		// "Last seen" columns were reading fields that never existed.
-		requireKeys(t, "GET /api/cache/top items[0]", keysOfField(t, body, "items", "0"),
-			wantKeys("bytes", "hits", "name", "qtype", "qtype_name"))
-	})
-
 	t.Run("settings", func(t *testing.T) {
 		code, body := h.get("/api/settings")
 		if code != http.StatusOK {
@@ -466,14 +417,6 @@ func TestRemainingEndpointKeySets(t *testing.T) {
 		))
 	})
 
-	t.Run("logs clear", func(t *testing.T) {
-		code, body := h.do(http.MethodPost, "/api/logs/clear", "")
-		if code != http.StatusOK {
-			t.Fatalf("POST /api/logs/clear = %d: %s", code, body)
-		}
-		requireKeys(t, "POST /api/logs/clear", keysOf(t, body), wantKeys("ok"))
-	})
-
 	t.Run("settings validate", func(t *testing.T) {
 		// A document that is valid: the issue lists are present and empty.
 		code, body := h.do(http.MethodPost, "/api/settings/validate",
@@ -516,43 +459,6 @@ func TestRemainingEndpointKeySets(t *testing.T) {
 		requireKeys(t, "POST /api/settings/reload", keysOf(t, body), wantKeys("ok", "version"))
 	})
 
-	t.Run("log stream ready frame", func(t *testing.T) {
-		// The stream never ends, so read the first frame and hang up: the
-		// console only needs to know the stream opened and what it carries.
-		req, _ := http.NewRequest("GET", "http://"+h.api+"/api/logs/stream", nil)
-		req.Header.Set("X-API-Key", h.key)
-		res, err := http.DefaultClient.Do(req)
-		if err != nil {
-			t.Fatalf("GET /api/logs/stream: %v", err)
-		}
-		defer res.Body.Close()
-		if res.StatusCode != http.StatusOK {
-			t.Fatalf("GET /api/logs/stream = %d", res.StatusCode)
-		}
-		br := newLineReader(res.Body)
-		var event, data string
-		for range 2 {
-			line, err := br.readLine()
-			if err != nil {
-				t.Fatalf("read stream: %v", err)
-			}
-			switch {
-			case line == "":
-			case len(line) > 7 && line[:7] == "event: ":
-				event = line[7:]
-			case len(line) > 6 && line[:6] == "data: ":
-				data = line[6:]
-			}
-			if event != "" && data != "" {
-				break
-			}
-		}
-		if event != "ready" {
-			t.Fatalf("first event = %q, want ready", event)
-		}
-		requireKeys(t, "GET /api/logs/stream ready frame", keysOf(t, []byte(data)),
-			wantKeys("at", "version"))
-	})
 }
 
 // quote renders a Go string as a JSON string literal.