Signal K Server: Buffered logs exposed to unauthenticated WebSocket clients

Summary

### Summary

An unauthenticated WebSocket client can subscribe to the log path and receive buffered server logs.

WebSocket connections are intentionally permitted before authentication because login occurs over the WebSocket connection. However, the log subscription path does not enforce an authorization check.

`processSubscribe` handles subscriptions to the log path separately, without applying access control:

```ts if ( Array.isArray(msg.subscribe) && msg.subscribe.length > 0 && msg.subscribe[0].path === 'log' ) { if (!spark.logUnsubscribe) { spark.logUnsubscribe = startServerLog(app, spark) } } else { // normal subscriptions go through subscriptionmanager, which applies // securityStrategy.filterReadDelta } ```

`startServerLog` then replays the whole buffer to that socket:

```ts app.logging.getLog().forEach((log) => { spark.write({ type: 'LOG', data: log }) }) ```

The asymmetry is inside this one file. Writes are gated by `securityStrategy.shouldAllowWrite` (`ws.ts:961`), normal delta subscriptions are filtered by `securityStrategy.filterReadDelta` (`ws.ts:1159`, the else branch of this same function), and the log branch consults neither.

An unauthenticated socket, which is legitimately open for login, can subscribe to `log` and receive buffered server logs.

Fix: Requires an administrator principal, before `startServerLog`, in the same way the other branch defers to `securityStrategy`. The fix was released with version 2.31.0-beta.1.

The investigated code path was reviewed at commit 26ab199. No server was run and no WebSocket frames were captured. AI assistance was used during the investigation.