v0.116.1: ungate /debug + /api/debug from logging.level — the viewer must exist wherever the ring does

Live validation at logging.level=info 404'd the whole debug surface (the
motivating incident's blind spot). Auth unchanged (RequireAuth + CSRF).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

controller/internal/web/templates/layout.html

@@ -31,7 +31,7 @@
             </li>
             <li><a href="/backups" class="{{if eq .Page "backups"}}active{{end}}"><svg class="ico"><use href="#i-shield"/></svg>Biztonsági mentés</a></li>
             <li><a href="/monitoring" class="{{if eq .Page "monitoring"}}active{{end}}"><svg class="ico"><use href="#i-cpu"/></svg>Rendszermonitor</a></li>
-            {{if .DebugMode}}<li><a href="/debug" class="{{if eq .Page "debug"}}active{{end}}"><svg class="ico"><use href="#i-wrench"/></svg>Debug</a></li>{{end}}
+            <li><a href="/debug" class="{{if eq .Page "debug"}}active{{end}}"><svg class="ico"><use href="#i-wrench"/></svg>Debug</a></li>
         </ul>
         <div class="sidebar-bottom">
             <div class="nav-group-label">Beállítások</div>