querylog: the writer queue defaults to 1024 entries, and a live stream allocates its ring on subscribe instead of at boot

PLAN.md

@@ -489,7 +489,7 @@ The sketch above is the original shape; `src/storage/querylog_schema.zig` is the
 
 ### 11.4 Query Logger
 
-- In-memory buffer, mutex guarded, hard cap `query_log_buffer_max` (default 10000).
+- In-memory buffer, mutex guarded, hard cap `query_log_buffer_max` (default 1024, from the measured queue peak; see specs/memory-budget.md item 4).
 - Flush: batch size (100, comptime) or max interval `query_log_flush_interval_s` (default 60s, 0–3600, 0 = do not wait). One transaction per interval: at household query rates a per-query commit costs orders of magnitude more disk writes than the rows are worth. The interval is also roughly what a crash costs, while the writer is healthy and the disk gate is open — a gated or lock-delayed batch is older, so it is a normal case, not a bound.
 - Privacy transforms (hide_domains / hide_client_ips) applied before persist + SSE fanout.
 - Backpressure: buffer full → drop oldest unflushed entry, increment monotonic `queries_dropped` (exposed in `/api/health` + `/metrics`). SSE fanout precedes buffer insert, so live viewers still see dropped-from-persistence entries.