logs: standardise log filenames to xamxam-{service}-{date}.log

docs/security.md

@@ -59,7 +59,8 @@ spoofing.
   files. The DocumentRoot is `app/public/` only.
 - Restricted-file downloads are gated by a request/approval/token flow
   (`file_access_*` tables).
-- Logs write to `app/storage/logs/` — outside the webroot, not publicly served.
+- Logs write to `/var/log/xamxam/` in production (and `app/storage/logs/`
+  only in dev/cli-server) — outside the webroot, not publicly served.
 
 ## Injection & output