feat(syslog): a syslog receiver: UDP and TCP, senders offered before they're kept, each source's lines in a ring (#5999)

- plugins/syslog: RFC 5424 and RFC 3164 parsing, RFC 6587 TCP framing.
- Lines are queued as they arrive and stored every 5 s through a Holding,
  so a storage stall delays them rather than losing them.
- A new sender is an offered source, counted and not kept, until an admin
  adds it on the Syslog page (name, host); it can be ignored instead.
- The listener follows the plugin's settings (port, UDP, TCP), rebinding
  within seconds of a save; a port it can't open is said on the page.
- Hourly ring per source: age window and byte cap from Settings.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

plugins/syslog/__init__.py

@@ -0,0 +1,40 @@
+# plugins/syslog/__init__.py
+from __future__ import annotations
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from quart import Quart
+
+_app: "Quart | None" = None
+
+
+def setup(app: "Quart") -> None:
+    global _app
+    _app = app
+    from .models import SyslogLine, SyslogSource  # noqa: F401 — registers the tables
+    from .receiver import close
+
+    # The listener is bound by the receive task, so it follows the settings
+    # and starts on a live enable too; it is closed with the app.
+    app.after_serving(close)
+
+
+def get_scheduled_tasks() -> list:
+    from .receiver import make_receive_task
+    from .retention import make_prune_task
+    return [make_receive_task(_app), make_prune_task(_app)]
+
+
+def get_blueprint():
+    from .routes import syslog_bp
+    return syslog_bp
+
+
+def get_nav() -> list[dict]:
+    return [{"label": "Syslog", "href": "/plugins/syslog/"}]
+
+
+def get_audit_entities() -> dict:
+    """Audit rows about a source name it and link to the Syslog page."""
+    from .models import SyslogSource
+    return {"syslog_source": (SyslogSource, "/plugins/syslog/")}