feat(debug-logs): enable E2EE debug logs from edgee launch

[KokaKiwi]

Checklist

• I have read the Contributor Guide
• I have read and agree to the Code of Conduct
• I have added a description of my changes and why I'd like them included in the section below

Description of Changes

Lets edgee launch derive an E2EE keypair for debug logs and attach the public half to every gateway-proxied request, without adding any friction for users who haven't opted in.

• Passphrase source: EDGEE_DEBUG_LOG_E2EE_PASSPHRASE env var, else the active profile's debug_log_e2ee_passphrase setting.
• Key derivation: Argon2id-derived X25519 keypair; only the public key + salt ever leave the process, attached as headers on every launch target (claude, codex, opencode, crush, codebuddy) and the relay/passthrough path.
• Fail-safe: if a passphrase is configured but key derivation fails, the launch aborts instead of silently falling back to plaintext logs.
• Docs: see gateway's docs/features/encrypted-debug-logs.md for the full construction and cross-repo invariants.

Related Issues

Related to EDGEE-1547

[CLEMENTINATOR]

Approving — CLI side is correct.

Verified:

• Passphrase-derived X25519 keypair; private key discarded, only pubkey+salt leave the process.
• Rule 5 honored: resolve_debug_log_keypair() returns Err on KDF failure (propagated via ? to abort launch), Ok(None) only when no passphrase is set — never silent plaintext fallback.
• Env var precedence over profile matches the doc.
• Header injection is safe across all targets (base64-STANDARD has no chars needing TOML/JSON/newline escaping); all 5 launch targets + relay covered.

Minor note: the passphrase can rest in cleartext in the CLI profile config — within spec (env var is the recommended source), but worth a doc callout as a secret at rest.