feat(logging): opt-in HTTP/WS body capture to an isolated, share-excluded gui_bodies.log

[kshitijk4poor]

Summary

Stacked on #49003 (base = feat/dashboard-ws-http-observability; will auto-retarget to main once that merges). Part of #49035.

#49003 added always-on metadata to the gui surface (method/path/status/latency + WS lifecycle). This adds the heavy diagnostic tier — actual HTTP request bodies and PTY/WebSocket frames — for the hard dashboard/TUI bugs where metadata alone isn't enough.

Body content can carry conversation data, so it is opt-in and built to be structurally incapable of leaking into a shared debug report (see #22016).

Design

• New config logging.capture_bodies (default false), surfaced in the dashboard / hermes tools config UI via _SCHEMA_OVERRIDES with a warning description.
• When enabled, bodies go to a separate gui_bodies.log written by a dedicated logger (hermes_body_capture, propagate=False) that is deliberately not a member of any COMPONENT_PREFIXES.

Four structural guarantees (all tested)

1. Not under any component prefix → bodies never land in gui.log / agent.log.
2. Not in hermes_cli/logs.py::LOG_FILES → not tailable via hermes logs.
3. Not in debug.py::_capture_default_log_snapshots() → never uploaded by hermes debug share.
4. Still redacted via RedactingFormatter as defence-in-depth.

Performance / safety

• Disabled state attaches a NullHandler and sets level above CRITICAL, so _capture_body() is a cheap no-op (single isEnabledFor check) on the hot path.
• Captured bodies truncated to 4096 bytes.
• request.body() is Starlette-cached, so reading it in the access middleware does not consume the stream for downstream handlers.
• Capture sites: HTTP request body (access middleware), PTY in/out frames.

Test plan

• pytest tests/test_hermes_logging.py tests/hermes_cli/test_debug.py tests/hermes_cli/test_web_server.py — 447 passed (3 pre-existing TestPtyWebSocket round-trip flakes, unrelated, deselected — they fail identically on the base branch in a sandboxed runner without a real TTY).
• New TestBodyCaptureOptIn (5 cases):
  • disabled-by-default → no gui_bodies.log, nothing captured
  • enabled → payload written to gui_bodies.log and absent from gui.log
  • large body truncates
  • body logger isolated from every COMPONENT_PREFIXES
  • body file excluded from both LOG_FILES and the debug-share snapshot set
• Live E2E against a temp HERMES_HOME: disabled → nothing; enabled → captured but isolated.

Usage

hermes config set logging.capture_bodies true   # or the dashboard toggle
# reproduce the issue, then read ~/.hermes/logs/gui_bodies.log directly
hermes config set logging.capture_bodies false  # turn it back off

gui_bodies.log is intentionally read-directly-only — never tailed by hermes logs, never shipped by hermes debug share.