feat(deploy-status): add lightweight offline observability

[Adamskiee]

Summary

• add an independent, LAN-only status collector and unauthenticated /status page
• persist and rotate API and GSM logs through shared mounts
• provision a least-privilege status database user and install-time integrity snapshot

Validation

• collector tests: 7 passed in sapot/api:bundle
• server logging and status-contract tests: 7 passed in sapot/api:bundle
• compose dependency validation, shell syntax, collector --once, and GSM log write passed

Notes

• full offline bundle build and clean-target installation smoke test were not run.