feat(activesync): optional per-device log error sampling

[TDannhauer]

Parent

Epic: horde/ActiveSync#99
Follow-up (after horde-activesync top)
Design: horde/ActiveSync doc/ops-monitor.md (§5.3, §9.2, Issue H)

Summary

Optional --scan-logs (or similar) on horde-activesync to sample recent per-device ActiveSync logs for error-rate signals (mtime/size / last matching ERR/Exception/KEYMISMATCH lines) without making log parsing the default hot path.

Acceptance

• Opt-in only (default path stays state-derived)
• Bounded work (tail/sample, not full historical parse)
• Clear when logging.type is not perdevice
• No log content with message bodies in JSON output

Supersedes

horde/hordectl#22 (wrong home — closed)