test(server): make an empty log capture unrepresentable

[plusky]

What

capture_logs now returns a Captured newtype instead of a bare String.
There is no Deref<Target = str> and no public contains. The captured
text is reachable only through a path that has already established the
capture is non-empty: assert_logged, Captured::assert_not_contains,
or as_str (which panics on empty).

The I12 call sites in config.rs and http_auth.rs migrate off raw
logs.contains(...). A Drop guard clears the thread-local capture
slot if f panics, so the debug_assert! on entry is no longer the
only defence against residue.

Why

A negative assertion over an empty capture is vacuously true and looks
identical to a passing I12 check. #96 closed that at the then-existing
call sites by convention (assert_captured / assert_logged first).
#105 then added new I12 negatives that went back to raw contains,
guarded only by a comment. The next test cannot express the vacuous
form at all.

Touches I12 only as test evidence: the production invariant is
unchanged, and the I12 negatives are stricter (silence now fails
closed as "captured nothing").

Verification

All five AGENTS.md commands, independently, on this tree:

• cargo fmt --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo clippy -p bugwarden --features gen --all-targets -- -D warnings
• cargo test --workspace --all-targets --locked (all passed)
• cargo deny check (advisories/bans/licenses/sources ok)

Adversarial review before opening:

• captured.contains("secret") does not compile (E0599, no method
  named contains on Captured; probe reverted).
• I12 negatives still fire on a non-empty capture that includes the
  token (assert_not_contains_fails_when_the_needle_is_present;
  config.rs / http_auth.rs use that same method on hush-key /
  WRITE / READ).
• test(server): capture logs through one process-wide subscriber #96 messages survive: empty is captured nothing: the subscriber saw no events; missing needle is captured logs lack ….
• No issues accepted from the review.

Closes #97.