feat: POST /log from the page + load state.json on page open

- Browser can record entries (e.g. meter readings) into session.md/jsonl;
  broadcast to other open clients. Log feed renders as text, not HTML.
- Page loads state.json on open instead of only localStorage, so a new
  device (or one that missed the WS push) shows current content.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

src/workbench/scaffold.html

@@ -114,18 +114,26 @@ function handleLog(entry) {
   const div = document.createElement('div');
   div.className = 'log-entry';
   const time = new Date().toLocaleTimeString();
-  div.innerHTML = `<span class="log-time">${time}</span>${entry}`;
+  const t = document.createElement('span');
+  t.className = 'log-time';
+  t.textContent = time;
+  div.append(t, entry);  // text, not HTML — browsers can POST entries now
   const feed = document.getElementById('log-entries');
   feed.appendChild(div);
   feed.scrollTop = feed.scrollHeight;
 }
 
-try {
-  const saved = JSON.parse(localStorage.getItem('workbench-state'));
-  if (saved) handleState(saved);
-} catch(e) {}
-
-connect();
+// state.json on disk is the source of truth; localStorage only covers the server being unreachable
+fetch('state.json', {cache: 'no-store'})
+  .then(r => r.json())
+  .then(s => { if (Object.keys(s).length) handleState(s); else throw 0; })
+  .catch(() => {
+    try {
+      const saved = JSON.parse(localStorage.getItem('workbench-state'));
+      if (saved) handleState(saved);
+    } catch(e) {}
+  })
+  .finally(connect);
 </script>
 </body>
 </html>