feat: 运维日志策略、玩家与服务器事件日志、滚动日志文件

- docs/logging.md 规定各级别写什么、永远不写什么，以及新增日志的做法
- core.log.ConnectionLog 统一写玩家（加入、离开、转服、转服失败、未能加入）和服务器
  （注册、地址变更、注销、不可达/恢复）事件，logger 为 moonbridge.players / moonbridge.servers
- LogText 清理对端与插件文本（控制字符、双向文字控制字符、长度上限），防止伪造日志行
- logging.playerAddresses 开关：false 时玩家地址写成 [hidden]
- Session 记录结束原因（先记录者为准），在 closePair 中写离开或未能加入的原因
- 合并的 WARN（ThrottledWarning）：连接数上限、插件命令/补全/事件/初次选服过载
- 控制通道：租约过期、注册被拒（按地址和原因去重）；插件启用/停用；启动与关闭摘要
- logback：控制台 + logs/latest.log，按天压缩滚动保留 14 天；测试只写控制台

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CLAUDE.md

@@ -59,6 +59,8 @@ testing/smoke/      smoke scripts and dated records; testing/benchmarks/ likewis
 
 **Buffer ownership.** Production runs with Netty leak detection disabled (`ProxyMain` sets `io.netty.leakDetection.level=disabled` before Netty loads unless the property is given), so refcounting must be right by construction. Do not write new `try/finally release()` blocks. Use `ByteBufs.fill/use` for allocate-write-release-on-failure, extend `FrameTransformHandler` for per-frame inbound handlers (its `transform` borrows the frame and returns what to forward), and use Netty's `MessageToMessageEncoder/Decoder` for codecs. Tests run every `proxy-core` test class under PARANOID leak detection: `LeakGate` (auto-registered via `junit-platform.properties`) fails a class that leaks a buffer. It cannot see `Unpooled.wrappedBuffer(byte[])` buffers, so assert `refCnt()` directly for those.
 
+**Operator logs.** docs/logging.md is the policy: INFO is one line per event an operator asks about, WARN is something to act on, protocol steps stay at DEBUG. Player and server events go through `core.log.ConnectionLog` (loggers `moonbridge.players` / `moonbridge.servers`), which cleans peer text with `LogText` and honours `logging.playerAddresses`; floods use `ThrottledWarning`. Sessions record why they ended with `endBecause` (first reason wins) and log it in `closePair`.
+
 **Backends and plugins.** Backends come from static config, plugin registration (`Servers.register`, owner-scoped handles with generations) or the optional control channel (`BackendControlService`: separate authenticated blocking sockets on virtual threads, leases that outlive short disconnects). Initial routing is fail-closed: with no placement plugin it uses only `initialRouting.servers`. Permissions are a provider interface (`PermissionService`) with per-connection subjects that are prepared before login admission and released on any exit.
 
 ## Testing notes