install-service: rotate /var/log/threatcrush (daily or 200M, keep 7)

[ralyodio]

dev2's /var/log/threatcrush/threatcrushd.log was 21 GB: nothing ever rotated it. install-service now writes /etc/logrotate.d/threatcrush (daily, or sooner at 200M, keep 7, compress + delaycompress). The daemon appends with appendFileSync, reopening the file on every line, so rename + create rotates cleanly. No copytruncate, which would copy 21 GB first. Skipped on boxes without /etc/logrotate.d.

Tests: renderLogrotate in service.test (pattern, daily/maxsize/rotate 7/compress, no copytruncate). CLI 526/526, tsc clean. logrotate -d on dev2 parses the config: "log needs rotating".

🤖 Generated with Claude Code

[github-actions]

ThreatCrush Security Scan

18 finding(s)

HIGH/CRITICAL: 1 | MEDIUM: 9 | LOW: 8

Severity	Rule	Location
HIGH	secret-aws-access-key	prd/0003-detect-hardcoded-secrets-before-they-are-committed-or-served.md:126
MEDIUM	sql-string-concatenation	.github/workflows/migrate-dev2.yml:128
MEDIUM	js-uninitialized-buffer	apps/cli/src/core/log-tail.ts:58
MEDIUM	js-open-redirect	apps/web/src/app/auth/login/page.tsx:67
MEDIUM	js-unescaped-html-sink	apps/web/src/app/hire/page.tsx:104
MEDIUM	js-unescaped-html-sink	apps/web/src/app/hire/page.tsx:108
MEDIUM	js-open-redirect	apps/web/src/app/invite/[token]/invite-client.tsx:55
MEDIUM	js-open-redirect	apps/web/src/components/funding/FundingClient.tsx:97
MEDIUM	js-unescaped-html-sink	apps/web/src/components/GuideReader.tsx:265
MEDIUM	js-uninitialized-buffer	packages/scan/src/node-rules.ts:456
LOW	secret-generic-credential	apps/web/src/app/api/auth/refresh/route.ts:17
LOW	secret-generic-credential	apps/web/src/app/api/auth/reset-password/route.ts:26
LOW	secret-generic-credential	apps/web/src/app/api/auth/reset-password/route.ts:27
LOW	secret-generic-credential	PRD.md:269
LOW	tls-verification-disabled	prd/0004-find-dangerous-code-patterns-without-pretending-to-be-a-compiler.md:121
LOW	tls-verification-disabled	prd/0004-find-dangerous-code-patterns-without-pretending-to-be-a-compiler.md:122
LOW	sh-remote-script-execution	scripts/smoke-test.sh:72
LOW	secret-aws-access-key	scripts/smoke-test.sh:150

Snippets are redacted; ThreatCrush never prints matched credential material.