feat(server/diagnostics): device debug-reporting ingest + admin timeline + retention (M9)

New diagnostic_events table + per-account users.debug_mode_enabled flag.
When an account's flag is on, its client(s) POST a batch timeseries of
connectivity / UPnP-sync / power / lifecycle events to /api/diagnostics
(no-op 204 when off, kind whitelist mirrors the CHECK constraint).

Admin surface: GET /api/admin/diagnostics (optional account/device/kind/
time-window filters, RFC3339-or-epoch-ms, export-sized paging) + a
/diagnostics/devices overview + PUT /api/admin/users/{id}/debug-mode to
flip an account remotely while a bug is live. debug_mode_enabled is now
exposed on /api/me (client gate) and the admin user views.

Retention: a 30-day gc-worker sweep (GcPruneDiagnostics), keyed on the
server clock so a skewed device clock can't keep rows alive.

Refs Scribe M9 (#119), tasks #1172 #1173.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01K55iTxn95BtshocgdE1shW

internal/db/queries/users.sql

@@ -55,7 +55,8 @@ WHERE id = $1;
 
 -- name: ListUsers :many
 -- Admin user-management list. Sort newest-first.
-SELECT id, username, display_name, is_admin, auto_approve_requests, created_at
+SELECT id, username, display_name, is_admin, auto_approve_requests,
+       debug_mode_enabled, created_at
   FROM users
  ORDER BY created_at DESC;
 
@@ -115,6 +116,15 @@ UPDATE users
  WHERE id = $1
 RETURNING *;
 
+-- name: SetDebugMode :one
+-- Toggle the per-account diagnostics/debug-reporting opt-in. Admin-driven
+-- from /admin (flip remotely while a bug is live) or self-driven OFF from
+-- the client. Returns the updated row so the handler can echo it.
+UPDATE users
+   SET debug_mode_enabled = $2
+ WHERE id = $1
+RETURNING *;
+
 -- name: ChangeUserPassword :exec
 -- Self-service password change. Caller (HTTP handler) verifies the
 -- current password before calling this. Distinct from