Goal: Bounded logs and reliable settings

Execute docs/goals/logging-and-config/PLAN.md, preserving existing dirty authentication work. Keep one log writer per owner, CLI-owned settings, and backward-compatible events. Capture deterministic CLI/filesystem acceptance evidence; no GUI, live VPN or real install is authorized. Report any unproved behavior explicitly.