Add drone-pilot logbook system (BEK 1649 §5)

Model Denmark's Dronebekendtgørelsen § 5 (on top of EU 2019/947) across all
three tiers: schema, API Server, and Web App.

Schema (migration 1720300700_add_logbook.js): two collections — `drones`
(classification inputs: mtom, is_toy, autologs, c_class, operator no.) and
`flights` (§5 minimum content + category/purpose/logging-path + operational
maturity + a retention_until computed as operation_date + 5y). Locked API
rules; access flows through the service account like users/orgs.

API Server (logbook.go, logbook_export.go): /api/drones and /api/flights CRUD
with per-role scoping in Go (user→own, admin→org, superadmin→all), plus
GET /api/logbook/export (CSV — the "readable electronic format" for
Trafikstyrelsen / pending police disclosure). Compliance is computed
server-side per flight: exemption (toy / club-area / <250 g hobby), effective
logging path, and red flags (autologs-without-FDR, specific-category-without-
authorisation, missing §5 fields, past retention). Manual-path saves missing a
§5 field are blocked (422).

Web App: BFF proxies (export preserves the CSV Content-Type/Disposition),
api.js client fns, and a Logbook.vue view (Flights/Drones tabs, inline forms,
compliance badges + expandable detail, Export CSV) wired into Dashboard.vue,
replacing the placeholder. Includes the rebuilt embedded dist bundle.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Web App/server/bff.go

@@ -371,6 +371,100 @@ func (a *App) handleDeleteOrg(w http.ResponseWriter, r *http.Request) {
 	a.doRelay(w, req)
 }
 
+/* ---------- Logbook: drones ---------- */
+
+// GET /bff/drones → API Server /api/drones
+func (a *App) handleListDrones(w http.ResponseWriter, r *http.Request) {
+	req, _ := http.NewRequest(http.MethodGet, a.apiBaseFor(r)+"/api/drones", nil)
+	req.Header.Set("Authorization", tokenOf(r))
+	a.doRelay(w, req)
+}
+
+// POST /bff/drones → API Server /api/drones
+func (a *App) handleCreateDrone(w http.ResponseWriter, r *http.Request) {
+	body, _ := io.ReadAll(r.Body)
+	req, _ := http.NewRequest(http.MethodPost, a.apiBaseFor(r)+"/api/drones", bytes.NewReader(body))
+	req.Header.Set("Authorization", tokenOf(r))
+	req.Header.Set("Content-Type", "application/json")
+	a.doRelay(w, req)
+}
+
+// PATCH /bff/drones/{id} → API Server /api/drones/{id}
+func (a *App) handleUpdateDrone(w http.ResponseWriter, r *http.Request) {
+	id := r.PathValue("id")
+	body, _ := io.ReadAll(r.Body)
+	req, _ := http.NewRequest(http.MethodPatch, a.apiBaseFor(r)+"/api/drones/"+url.PathEscape(id), bytes.NewReader(body))
+	req.Header.Set("Authorization", tokenOf(r))
+	req.Header.Set("Content-Type", "application/json")
+	a.doRelay(w, req)
+}
+
+// DELETE /bff/drones/{id} → API Server /api/drones/{id}
+func (a *App) handleDeleteDrone(w http.ResponseWriter, r *http.Request) {
+	id := r.PathValue("id")
+	req, _ := http.NewRequest(http.MethodDelete, a.apiBaseFor(r)+"/api/drones/"+url.PathEscape(id), nil)
+	req.Header.Set("Authorization", tokenOf(r))
+	a.doRelay(w, req)
+}
+
+/* ---------- Logbook: flights ---------- */
+
+// GET /bff/flights → API Server /api/flights
+func (a *App) handleListFlights(w http.ResponseWriter, r *http.Request) {
+	req, _ := http.NewRequest(http.MethodGet, a.apiBaseFor(r)+"/api/flights", nil)
+	req.Header.Set("Authorization", tokenOf(r))
+	a.doRelay(w, req)
+}
+
+// POST /bff/flights → API Server /api/flights
+func (a *App) handleCreateFlight(w http.ResponseWriter, r *http.Request) {
+	body, _ := io.ReadAll(r.Body)
+	req, _ := http.NewRequest(http.MethodPost, a.apiBaseFor(r)+"/api/flights", bytes.NewReader(body))
+	req.Header.Set("Authorization", tokenOf(r))
+	req.Header.Set("Content-Type", "application/json")
+	a.doRelay(w, req)
+}
+
+// PATCH /bff/flights/{id} → API Server /api/flights/{id}
+func (a *App) handleUpdateFlight(w http.ResponseWriter, r *http.Request) {
+	id := r.PathValue("id")
+	body, _ := io.ReadAll(r.Body)
+	req, _ := http.NewRequest(http.MethodPatch, a.apiBaseFor(r)+"/api/flights/"+url.PathEscape(id), bytes.NewReader(body))
+	req.Header.Set("Authorization", tokenOf(r))
+	req.Header.Set("Content-Type", "application/json")
+	a.doRelay(w, req)
+}
+
+// DELETE /bff/flights/{id} → API Server /api/flights/{id}
+func (a *App) handleDeleteFlight(w http.ResponseWriter, r *http.Request) {
+	id := r.PathValue("id")
+	req, _ := http.NewRequest(http.MethodDelete, a.apiBaseFor(r)+"/api/flights/"+url.PathEscape(id), nil)
+	req.Header.Set("Authorization", tokenOf(r))
+	a.doRelay(w, req)
+}
+
+// GET /bff/logbook/export → API Server /api/logbook/export. Unlike the JSON
+// endpoints this streams a CSV download, so it preserves the upstream
+// Content-Type + Content-Disposition instead of forcing application/json.
+func (a *App) handleExportLogbook(w http.ResponseWriter, r *http.Request) {
+	req, _ := http.NewRequest(http.MethodGet, a.apiBaseFor(r)+"/api/logbook/export", nil)
+	req.Header.Set("Authorization", tokenOf(r))
+	resp, err := client.Do(req)
+	if err != nil {
+		writeJSON(w, http.StatusBadGateway, map[string]any{"error": "cannot reach API server"})
+		return
+	}
+	defer resp.Body.Close()
+	if ct := resp.Header.Get("Content-Type"); ct != "" {
+		w.Header().Set("Content-Type", ct)
+	}
+	if cd := resp.Header.Get("Content-Disposition"); cd != "" {
+		w.Header().Set("Content-Disposition", cd)
+	}
+	w.WriteHeader(resp.StatusCode)
+	_, _ = io.Copy(w, resp.Body)
+}
+
 // doRelay executes an outbound request and relays the response verbatim.
 func (a *App) doRelay(w http.ResponseWriter, req *http.Request) {
 	resp, err := client.Do(req)