feat(y-log): 操作日志上报（前端直连 + 后端公开只读下发地址）

- 后端新增 y_log 公开只读配置：YLogConfig + AppConfig.y_log +
  GET /api/public/config/y-log，地址写在 config.yaml（mtime 热重载）
- 前端核心 src/core/log/：writeYLog（双门控/异步即发即忘/永不抛错/
  去ip-host/对象序列化裁剪/optResult恒0）+ 配置加载 + token1 隔离存取
- 登录(token)持久化 token1 并报登录、登出先报后清；启动预热配置
- 各 API client 成功路径埋点：敏感词/菜单/按钮/技能地址/轻应用、
  会商草稿+任务草稿+后台任务、智能体/定时任务/知识库、Word导出，
  以及问答完成钩子(ChatPage/AgentChatPage onFinish)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

frontend-web/src/components/workspace/settings/account-settings-page.tsx

@@ -7,6 +7,8 @@ import { toast } from "sonner";
 import { Badge } from "@/components/ui/badge";
 import { Button } from "@/components/ui/button";
 import { clearStoredAuth, getAccountDisplayName, getStoredAuth } from "@/core/auth";
+import { OptType, writeYLog } from "@/core/log/y-log";
+import { clearYLogToken } from "@/core/log/y-log-token";
 
 import { SettingsSection } from "./settings-section";
 
@@ -40,7 +42,15 @@ export function AccountSettingsPage() {
   const displayName = getAccountDisplayName(auth);
 
   const handleLogout = () => {
+    // 操作日志(Y-Log)：在清除 token1 之前上报登出（此时 token1 还在），keepalive 保证发出。
+    writeYLog({
+      optType: OptType.logout,
+      optDetail: "B1-CM助手-登出",
+      url: "/api/v1/auth/logout",
+      keepalive: true,
+    });
     clearStoredAuth();
+    clearYLogToken();
     // Match the rest of the app's logout flow: blow away the cookie session
     // by hitting the gateway logout endpoint and then forcing a full reload
     // so any cached query state goes too.