feat: business payload logging toggle (privacy-first, default off)

[jkjk02]

Business payload logging toggle (privacy-first)

Adds a platform-wide switch so operators can prove to customers that request/response bodies are not stored — and optionally enable full capture for debugging.

• OFF by default (PayloadLogEnabled=false): zero overhead, nothing captured; the platform keeps only billing/ops metadata. Middleware fast-path: if !common.PayloadLogEnabled { c.Next(); return }.
• ON: relay request + response bodies (capped 256KB each) are stored in a new payload_logs table and viewable in a root-only Payload Logs console page (sidebar).

Backend

• common/constants.go PayloadLogEnabled (option template = LogConsumeEnabled; registered in model/option.go).
• model/payload_log.go model + migration (model/main.go).
• middleware/payload_log.go capture (reuses audit.go's response-writer wrapper) mounted on the relay httpRouter.
• controller/payload_log.go + router/api-router.go admin query API (/api/payload_log/).

Frontend

• features/payload-logs/* + route /payload-logs (SUPER_ADMIN): switch + log table + request/response detail dialog.
• Sidebar entry (hooks/use-sidebar-data.ts), i18n (en+zh).

Verify

• go build ./... PASS · bun install + bun run build PASS (routeTree regenerated) · tsgo typecheck PASS.
• routeTree.gen.ts intentionally not committed; the Docker bun run build regenerates it.