Klever-Go: /log controls global node logging

An unauthenticated client can connect to `GET /log`, send an arbitrary logger profile as the first WebSocket message, and mutate the node's global logging configuration before receiving live logs from the process. I confirmed this against a local validator built from this repository: an unauthenticated client set the global log level to `*:NONE`, the node accepted the profile, and the node stopped emitting normal slot logs while the WebSocket connection remained open. This is not a duplicate of the published KVM or P2P advisories. It is a management-plane flaw in the public WebSocket logging endpoint. ## Vulnerability details ### Affected code - Route exposed by default in `config/node/api.yaml` - Route registration in `network/api/api.go` - Unauthenticated upgrade in `network/api/api.go` - First client message is parsed as a logger profile and applied globally in `network/api/logs/logSender.go` - Global logger mutation happens in dependency `github.com/klever-io/klever-go-logger`, `profile.go`, `Apply()` ### Root cause `/log` is enabled by default and does not require authentication. After the WebSocket upgrade, the server reads the first client message and treats it as a logger `Profile`. That profile is then applied process-wide through `profile.Apply()`, which changes global log level patterns and output formatting options for the whole node. After that handshake, the same unauthenticated connection is registered as a log observer and receives live logs from the running p