fix(live): public log is node-only — drop client-generated SYS/lifecycle lines

/live generates its own SYS entries (Testing started/stopped, Round N
starting/done, gap countdowns) in response to state/loop SSE events —
these never pass through the server's node-only log filtering. When the
log-filter tabs were removed and the log unified, those previously-
filterable SYS lines became permanently visible.

appendLog now drops explicit-cat 'sys'/'events' objects so the public log
shows only node activity (cat 'node') and node failures (cat 'fail', kept
per the failure-log UX). Raw server-forwarded strings are NOT re-judged —
they're already node-filtered server-side (publicLogBuffer + the
/api/public/events sys/events drop), so the weaker client string heuristic
must not second-guess them.

Author: Sentinel-Bluebuilder

live.html

@@ -1411,6 +1411,16 @@ <h1 class="live-page-title">
         o = opts || {};
       }
 
+      // Public /live is NODE-ONLY: drop the operator/system + lifecycle entries
+      // the client generates itself (Testing started/stopped, Round N starting/
+      // done). Node activity (cat 'node') and node failures (cat 'fail') stay —
+      // the failure-log UX requires failures to remain visible. Only gate
+      // explicit-cat objects: raw strings here are already node-filtered
+      // server-side (publicLogBuffer + the /api/public/events sys/events drop),
+      // so re-judging them with the weaker string heuristic would risk hiding a
+      // legitimate node line the server already approved.
+      if (typeof opts !== 'string' && (o.cat === 'sys' || o.cat === 'events')) return;
+
       const div = document.createElement('div');
       const cls =
         o.status === 'fail' ? 'log-err'  :