feat: error log admin diagnostics + multi-role dean login fix (#397)

[y4nder]

Two related changes bundled together — the dean login 500 was the catalyst for the diagnostic page, so both ship in the same PR.

Error log admin diagnostics

Captures unhandled 5xx exceptions so they're visible on the admin console instead of vanishing into a generic 500 response.

• new error_log table (entity + migration) — never soft-deleted, indexed on status_code / path / user_id / error_name / acknowledged_at / occurred_at for filter performance
• SystemErrorsModule (src/modules/system-errors/) mirrors AuditModule shape: ErrorLogService.Emit() async-enqueues via BullMQ, ErrorLogProcessor persists, ErrorLogQueryService handles paginated reads + acknowledge flow, ErrorLogController exposes /error-logs endpoints behind a @UseJwtGuard(SUPER_ADMIN)
• ErrorCaptureFilter global exception filter: catches everything, only persists ≥500, redacts sensitive keys (password/token/refreshToken/authorization etc.) and caps payload depth/breadth/string length, then defers to BaseExceptionFilter so the wire response is byte-identical to today
• ErrorLogCleanupJob daily at 04:00 UTC — 90-day retention via nativeDelete on occurred_at
• 12 new unit tests covering sanitizer behaviour and filter capture paths (4xx skipped, 5xx captured, non-http hosts skipped, capture failures swallowed without re-throwing)

Multi-role dean login fix (ucmn-t-67092)

Adds defensive guards to MoodleUserHydrationService.resolveInstitutionalRoles so users with both DEAN and CHAIRPERSON institutional roles can log in when the populated moodleCategory relation is null (soft-delete filter or drift after Moodle restructure). Seven previously-unguarded ir.moodleCategory.moodleCategoryId dereferences now optional-chain

• filter; orphaned auto rows are now removed instead of crashing. Regression tests cover both DEAN-orphan and CHAIRPERSON-orphan shapes.

Single-role deans skip the (DEAN ∧ CHAIRPERSON) cleanup branch, which is why only the intersection user tripped the TypeError.

Migration scope (verified safe on staging)

This migration also adds analysis_pipeline_trigger_check — @Enum(() => PipelineTrigger) is declared on the entity but the CHECK was missing from the DB. Verified: 0 violating rows, no name collision.

Does NOT include the CLI-suggested
drop index uq_analysis_pipeline_active_scope. That's the FAC-132 partial unique index — MikroORM decorators can't represent it (see new gotcha entry in src/entities/CLAUDE.md) and dropping it would reintroduce the duplicate-active-pipeline bug it fixed.