refactor: move legacy-logs migration into local storage adapter

[lis186]

Addresses the require-time migration hygiene item raised during the #50/#51/#52 CCXRAY_HOME work (Codex review of the merged state flagged it as should-fix).

Problem

server/config.js ran the one-time legacy-logs migration as a top-level side effect at require time:

1. Fires on every import — 9 modules require('./config'), so the mkdir + file-move ran far beyond startup.
2. Ignores STORAGE_BACKEND — under STORAGE_BACKEND=s3, it created a local logs dir and moved legacy logs into a directory the server never reads.

Approach (chosen from a 5-way spike + Codex comparison: B > C > A > D > E)

Fold the migration into the local storage adapter's init() (server/storage/local.js), where the logs dir is already created:

• Backend-gated by construction — only the local adapter has this logic; storage/index.js passes legacyDir solely on the local branch, so S3/R2 can never run it (no flag to forget).
• Guard preserved — init() snapshots whether the logs dir existed before mkdir, so migration only ever runs into a freshly-created dir (mirrors the original if (!existsSync(LOGS_DIR)), never clobbers populated logs).
• Best-effort — a failed rename is caught and logged, never crashing startServer()/init() (matches the original catch-and-log).
• config.js becomes pure — drops fs, path, and LEGACY_LOGS_DIR; zero filesystem side effects at import.
• No new startup call site — index.js already await config.storage.init().

Why not the alternatives

• E (remove auto-migration + warn) was a risky behavior change pointing at an unwired command.
• A/C/D keep an existsSync(logsDir) guard that is only valid because they run before storage.init() — fragile ordering. B runs inside init() via the existed-snapshot, so the guard is robust.

Tests

Previously untested. Adds 6 focused tests (test/legacy-migration.test.js): require-time purity, fresh migrate, no-sentinel skip, existing-dir no-clobber, no-legacyDir (S3 path), and best-effort error handling.

Verification

• node -c on all changed files.
• Full suite: 778/778 (was 772; +6 new).

Out of scope

ratelimit-log.js:78 dir-ensure nit — intentionally left as-is (it's an intentional fire-and-forget design; documented in the #51 discussion).