fix(gateway): aggregate the full audit history, repair record paging

Two problems reported after the on-demand log work landed.

1. Dashboard totals were wrong. LoadAudit only replayed the last 4 MB of the
   audit file, so requests/tokens/per-key rows reflected a window instead of all
   time — a regression in reported numbers, not just in presentation.

   The aggregates are now built by streaming EVERY audit file (oldest first, so
   the hourly quota buckets keep their intended trailing window) and keeping
   nothing per record: aggregate maps are keyed by key/model/source, so their
   size is bounded by cardinality. Measured on the production host: 29 MB /
   221k lines / 37k requests in ~260 ms at startup.

   What stays bounded is the RAW-record ring: a fixed-size reqRing keeps only the
   newest maxRecs records, so the ~25 MB that used to be spent appending every
   record into a slice is still saved. auditReplayBytes is gone, and
   replayPartial now means "an audit file could not be read", which is the only
   remaining way for the totals to be incomplete.

2. Scrolling to the bottom stopped loading more records. Two independent causes:

   * paintRecords rebuilt the entire table on every 5s poll whenever the row
     count did not exceed the first screen — the "is a paged view live?" test
     compared row counts and matched exactly on the first refresh — wiping loaded
     pages and resetting scroll position.
   * IntersectionObserver only fires on TRANSITIONS. With a short list, or after a
     page whose rows all duplicated the first screen, the sentinel stayed visible
     and never fired again.

   paintRecords now builds once (recsState.built) and later polls PREPEND only
   genuinely new rows; attachRecsObserver adds a scroll-position fallback;
   fillRecordsViewport loads until the list actually overflows; and
   loadMoreRecords chains (bounded) when a page yields no new rows, since the
   first fetch necessarily overlaps the first screen.

TestUIRecordsPagingWiring pins all four mechanisms structurally, since none of
them is reachable from Go. Test names/comments referring to bounded replay are
updated to describe the bounded RING instead, and both READMEs now state that
totals come from the full history while records are paged.

internal/gateway/ui_contract_test.go

@@ -176,3 +176,76 @@ func oneLine(s string) string {
 	}
 	return s
 }
+
+// TestUIRecordsPagingWiring guards the record table's paging plumbing. Two
+// separate bugs made "scroll to the bottom" silently stop loading:
+//
+//  1. paintRecords rebuilt the whole table on every 5s poll whenever the row
+//     count did not exceed the first screen, wiping loaded pages and resetting
+//     scroll position.
+//  2. IntersectionObserver only fires on TRANSITIONS. With a short list — or a
+//     page whose rows all duplicated the first screen — the sentinel stayed
+//     visible and never fired again.
+//
+// The fixes are a build-once flag, a scroll-position fallback, an initial
+// viewport fill, and chaining when a page yields no new rows. None of that is
+// reachable from Go, so the wiring is asserted structurally.
+func TestUIRecordsPagingWiring(t *testing.T) {
+	src := uiSource(t)
+
+	paint, ok := jsFunctionBody(src, "paintRecords")
+	if !ok {
+		t.Fatal("paintRecords() not found")
+	}
+	if !strings.Contains(paint, "recsState.built") {
+		t.Error("paintRecords must build the table once (recsState.built) instead of rebuilding on every poll")
+	}
+	if !strings.Contains(paint, "afterbegin") {
+		t.Error("paintRecords must PREPEND newer rows on later polls, not rebuild the table")
+	}
+	if !strings.Contains(paint, "fillRecordsViewport") {
+		t.Error("paintRecords must fill the viewport so the sentinel can transition")
+	}
+
+	attach, ok := jsFunctionBody(src, "attachRecsObserver")
+	if !ok {
+		t.Fatal("attachRecsObserver() not found")
+	}
+	if !strings.Contains(attach, "IntersectionObserver") {
+		t.Error("attachRecsObserver must still use IntersectionObserver")
+	}
+	if !strings.Contains(attach, `addEventListener("scroll"`) {
+		t.Error("attachRecsObserver needs a scroll fallback: an already-visible sentinel never fires again")
+	}
+
+	load, ok := jsFunctionBody(src, "loadMoreRecords")
+	if !ok {
+		t.Fatal("loadMoreRecords() not found")
+	}
+	if !strings.Contains(load, "maxChain") {
+		t.Error("loadMoreRecords must chain when a page adds no new rows (the first page overlaps the first screen)")
+	}
+	if !strings.Contains(load, "signal: ctrl.signal") {
+		t.Error("loadMoreRecords must remain abortable")
+	}
+
+	fill, ok := jsFunctionBody(src, "fillRecordsViewport")
+	if !ok {
+		t.Fatal("fillRecordsViewport() not found")
+	}
+	for _, want := range []string{"scrollHeight", "clientHeight"} {
+		if !strings.Contains(fill, want) {
+			t.Errorf("fillRecordsViewport must compare %s to decide whether the list overflows", want)
+		}
+	}
+
+	rel, ok := jsFunctionBody(src, "releaseRecords")
+	if !ok {
+		t.Fatal("releaseRecords() not found")
+	}
+	for _, want := range []string{"observer.disconnect()", "removeEventListener", "abort()", "recsState.built = false"} {
+		if !strings.Contains(rel, want) {
+			t.Errorf("releaseRecords must clean up %s", want)
+		}
+	}
+}