Harden the public dashboard: id bounds, read-only role, error and worker redaction, log rotation

[MaciejZiel]

Fixes from the review:

• ids in /api/jobs/{id} and before_id are bounded to 1..2^63-1 (422 instead of 500)
• the boot script log is size-capped by deploy/termux/logcap.sh (default 1 MiB, 2 old files)
• setup-db.sh: SELECT-only role pgqueue_demo_ro, connection limits (40 / 10), REVOKE CONNECT FROM PUBLIC; read-only app uses PGQUEUE_READONLY_DSN
• public API returns only the last error line without absolute paths and a stable worker label (no hostname/pid); full detail stays in the DB and the non-read-only admin

Tests added for each point.

[MaciejZiel]

Superseded by the rebased PR.