Add unified logs platform with Helm-managed central Elasticsearch.

Deploy cloudhost-logging on cluster registration, ship app and optional service logs to ES with owner isolation, and fix Kibana 8.12 auth via kibana_system.

Co-authored-by: Cursor <cursoragent@cursor.com>

frontend/src/app/dashboard/admin/clusters/page.tsx

@@ -5,7 +5,7 @@ import { useQuery, useMutation, useQueryClient } from '@tanstack/react-query';
 import api from '@/lib/api';
 import { toast } from 'react-toastify';
 import type { Cluster, ClusterResources } from '@/types';
-import { Server, CheckCircle, XCircle, BarChart3, Clock, RotateCw, Plug, X } from 'lucide-react';
+import { Server, CheckCircle, XCircle, BarChart3, Clock, RotateCw, Plug, X, ScrollText, Copy } from 'lucide-react';
 import { useConfirm } from '@/components/confirm-modal';
 
 function ResourcePanel({ clusterId }: { clusterId: string }) {
@@ -120,6 +120,100 @@ function ResourcePanel({ clusterId }: { clusterId: string }) {
   );
 }
 
+function CentralLoggingPanel() {
+  const queryClient = useQueryClient();
+  const { data: status, isLoading } = useQuery({
+    queryKey: ['admin-elasticsearch-status'],
+    queryFn: () => api.get('/admin/elasticsearch/status').then((r) => r.data),
+  });
+
+  const deployMutation = useMutation({
+    mutationFn: () => api.post('/admin/elasticsearch/deploy'),
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ['admin-elasticsearch-status'] });
+      toast.success('Logging stack deployment started');
+    },
+    onError: () => toast.error('Failed to deploy logging stack'),
+  });
+
+  const undeployMutation = useMutation({
+    mutationFn: () => api.delete('/admin/elasticsearch/undeploy'),
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ['admin-elasticsearch-status'] });
+      toast.success('Logging stack removed');
+    },
+  });
+
+  const kibanaCmd = 'kubectl port-forward svc/kibana 5601:5601 -n logging';
+
+  return (
+    <div className="card p-4 border border-indigo-100 bg-indigo-50/30">
+      <div className="flex flex-wrap items-start justify-between gap-3 mb-3">
+        <div>
+          <h2 className="text-lg font-semibold text-gray-900 flex items-center gap-2">
+            <ScrollText className="w-5 h-5 text-indigo-600" /> Central logging (Elasticsearch)
+          </h2>
+          <p className="text-sm text-gray-600 mt-1">
+            Required for the unified Logs page. Installed automatically via Helm when a cluster is registered.
+            End users never get Kibana access — staff use port-forward.
+          </p>
+        </div>
+        <div className="flex gap-2">
+          {!status?.deployed ? (
+            <button
+              type="button"
+              onClick={() => deployMutation.mutate()}
+              disabled={deployMutation.isPending}
+              className="btn-primary text-sm"
+            >
+              {deployMutation.isPending ? 'Deploying…' : 'Deploy stack'}
+            </button>
+          ) : (
+            <button
+              type="button"
+              onClick={() => undeployMutation.mutate()}
+              disabled={undeployMutation.isPending}
+              className="btn-secondary text-sm text-red-600"
+            >
+              Remove stack
+            </button>
+          )}
+        </div>
+      </div>
+      {isLoading ? (
+        <p className="text-sm text-gray-500">Checking status…</p>
+      ) : status?.deployed ? (
+        <div className="text-sm space-y-2">
+          <p className="text-green-700 font-medium flex items-center gap-1">
+            <CheckCircle className="w-4 h-4" /> Deployed · health: {status.health?.status || 'unknown'}
+          </p>
+          <div className="bg-white rounded-lg p-3 border border-gray-200">
+            <p className="text-xs font-medium text-gray-600 mb-1">Kibana (staff only)</p>
+            <div className="flex items-center gap-2 font-mono text-xs">
+              <code className="flex-1 break-all">{kibanaCmd}</code>
+              <button
+                type="button"
+                onClick={() => {
+                  navigator.clipboard.writeText(kibanaCmd);
+                  toast.success('Copied');
+                }}
+                className="p-1 text-gray-500 hover:text-gray-800"
+              >
+                <Copy className="w-4 h-4" />
+              </button>
+            </div>
+            <p className="text-xs text-gray-500 mt-1">Then open http://localhost:5601</p>
+          </div>
+        </div>
+      ) : (
+        <p className="text-sm text-amber-700">
+          Not deployed on the default cluster. New clusters install this automatically; use Deploy for existing clusters.
+        </p>
+      )}
+    </div>
+  );
+}
+
 export default function AdminClustersPage() {
   const queryClient = useQueryClient();
   const confirm = useConfirm();
@@ -208,6 +302,8 @@ export default function AdminClustersPage() {
         </button>
       </div>
 
+      <CentralLoggingPanel />
+
       {showForm && (
         <div className="card space-y-4 animate-slide-up">
           <h2 className="text-lg font-semibold text-gray-900">Register New Cluster</h2>