Function build_log_plugin 

pub(crate) fn build_log_plugin() -> TauriPlugin<Wry>

Cached thumbnails are handed to the webview as asset-protocol URLs by convertFileSrc (asset://localhost/… on Linux/macOS, http://asset.localhost/… on Windows/Android). Tauri only answers that origin when the protocol-asset cargo feature is compiled in and app.security.assetProtocol.enable is set in tauri.conf.json. Both are required together: with either missing the URL resolves to nothing and the webview reports NETWORK_NO_SOURCE, which is how offline video came to fail silently.

The scope is $APPDATA/thumbnails/**, not the storage root: downloaded media moved to the loopback media server in DR-137, so imageCache is the only remaining convertFileSrc caller and the database and the encrypted-token fallback file — which share that root — never need to be readable by the webview. Widen it only if something other than thumbnails starts resolving through convertFileSrc again.

TRACES: UR-012, UR-071 | DR-134, DR-137, DR-198 Build the logging plugin.

Replaces the previous env_logger init, which wrote to stdout only. That was invisible to anyone who launched from a desktop icon, and worse than useless on Android: stdout is not logcat, so the Rust backend produced no visible output at all on the platform carrying the hardest bugs in this project’s history (the autoplay deadlock, the truncated-stream restart, the background-audio stall). tauri-plugin-log routes to logcat there for free.

Three decisions worth keeping:

• Every line goes through redact first. A credential must never reach disk, not merely be stripped later when a bundle is exported — a file on the device is already the disclosure.
• The size cap is deliberate. RotationStrategy::KeepAll would let a long-running session fill a phone. One rotation keeps yesterday’s evidence without unbounded growth.
• The level is read from disk. Someone reproducing a bug needs debug logging to survive the restart that reproduces it.

TRACES: UR-078 | DR-218