build log --follow, streamed to the build page !462

build log <owner/name> <n> --follow streams a build's log until it has an outcome; the build page streams the same command without JavaScript.

• Store: waiters per build, woken by append, finish and cancel; BuildLogFrom reads status and bytes past an offset in one query (byte offsets via CAST(log AS BLOB)).
• Command: stored log, then new output, then build <n> <status> on stderr, exit 0 whatever the outcome. 2 s fallback re-read, 1 s settle after the outcome, 8 follows per account (signed-out viewers share account 0). A follow of a build still queued after 10 minutes ends with a message and exit 1.
• Ctx.Done: the embedded sshd closes it when the session channel closes; the web and both API endpoints use the request context. gitbayd shell passes nil.
• Web: GET on a queued or running build renders the page around a marker, flushes the head, streams the escaped log, then writes "build finished: " and the rest. ?follow=0 and HEAD render once. gzipWriter gains Flush, FlushError, Unwrap.
• API: --follow answers when the build ends, with the whole log.
• Tests: store, control (follow, cancel, Done, cap, queued limit), gzip flush, e2e following a hand-driven runner over ssh and on the page.
• Docs: spec and plan under docs/, Parity row, CI and Admin wiki pages.

Follow-ups not in this MR: shutdown does not end open follows, access is not re-checked mid-follow, each append re-reads the log per follower, no sshd channel-close unit test.

Closes #250