docs(tunnel): LPM CLI keeps captures out of git

[tolgaergin]

Documents lpm-dev/rust-client#952. Merge with it, or once it's released.

• infra/tunnel.mdx, capture history:
  • LPM CLI adds inspector.db* to .lpm/.gitignore before it creates the capture database, unless the file already ignores the captures. It leaves a linked or read-only .lpm/.gitignore alone.
  • lpm tunnel and lpm dev --tunnel make the capture files owner-only on Unix: .lpm writable by its owner alone, with macOS extended ACL entries removed. A database other users could read is replaced with an owner-only copy, after a damage check and a check of the disk room the copy needs, unless another process has it open. On a filesystem without Unix modes, or a macOS volume that ignores ownership, the warning says the database is open to other users.
  • inspect, log, replay and inspect --ui change no file's access, work while a tunnel records, and warn when others could read the database, saying whether a tunnel run can change that.
  • Root accepts the project owner's files and gives them what it creates.
  • LPM CLI refuses links, other hard links, another user's files, and a database holding anything LPM CLI never creates. Opening waits up to 10 seconds for another run.
  • The capture warning asks the project's repository and git inside .lpm, says when git ignores the files, names those it doesn't, and names those a repository tracks, with the git rm --cached command for each repository and the advice to rotate the credentials they held. In a repository, it names each one whose query didn't answer; outside any, it says nothing of git.
  • log --clear overwrites the cleared captures and empties the write-ahead log. A damaged database is moved aside.
  • This replaces "Add .lpm/inspector.db* to .gitignore".
• infra/tunneling.mdx: the storage section says the same in one sentence, and that log --clear overwrites the cleared captures.

npm run check passes: content dates, SEO, lint, types, unit and component tests, and the build.

🤖 Generated with Claude Code

[tolgaergin]

Round 11, and the Astra and Sol review

The ledger is on lpm-dev/rust-client#952: lpm-dev/rust-client#952 (comment).

This PR's changes (c95aecb, dates in 2eaf106):

• Root records another user's captures as that user on Linux, and refuses elsewhere, replacing the trust the paragraph described (R952-PARENT).
• .git entries are read by git 2.53's rules.
• A refused sidecar isn't removed.
• The replacement and git-query paragraphs are lists now, per Astra and Sol's editorial note.

npm run check passes.

[tolgaergin]

Third review: ledger

Fixed in 1b7faa1, with lpm-dev/rust-client#952 at 95c5dba7e. npm run check passes.

Finding	Outcome
P2, security (tunnel.mdx:294, 301, 341): "move the database aside" didn't say where, so captured authorization headers, cookies, bodies and webhook signatures could end up readable or committed	Fixed: move it somewhere only you can read, outside source control, under a name that still starts inspector.db, so git goes on ignoring it.
P3 (tunnel.mdx:338): "the log is removed" was too strong, as persistent WAL can keep a zero-byte -wal file	Fixed: the log is emptied.
P3 (tunnel.mdx:284-324): permissions, recovery, git cleanup, history rewriting and credential rotation were one run of paragraphs	Fixed: separate sections, with a CAUTION before rewriting history. The page also describes the path check and root's hand-over of .lpm from #952.

[tolgaergin]

Rewrote this PR's changed passages in plain English (the simple-english skill, Plain mode): sentences of at most 20 words for steps and 25 for descriptions, active voice, can/will/must instead of other modals, no contractions, semicolons or em-dashes, each condition before its result, and cautions with the instruction first. Code, identifiers, quoted messages and facts are unchanged. npm run check passes.