#9722 improvement(logs): log each admission refusal once per window and demote per-request success chatter to debug

Summary

• Admission gate warnings (ban, usage limit, rate limit, reservation) now go through the existing blocked-run throttle with their error row. A sender redelivering into a refusal logs once per window instead of on every attempt. Callers that don't throttle still log every refusal.
• The webhook processor's "Webhook preprocessing failed" line moves to debug: preprocessing already logs every failure it returns, with more detail.
• Per-request success-path chatter moves to debug: preprocessing steps, valid-token checks, billing intermediate steps, Slack trigger-filter skips (one line per webhook per event), table row upserts, trigger and workflow-state selection, and storage uploads. The billing top-up line stays at info and now carries the payer and model.
• PostHog upstream connection failures log at warn instead of error; the response to the browser is unchanged.
• The idempotency failure warning uses a static message with the key and error as fields, so it groups in queries.

Type of Change

• Improvement

Testing

• New regression test: repeated throttled refusals of one workflow log a single warning. It fails on the previous code (3 warnings) and passes now.
• Ran the touched and sibling suites: preprocessing, webhook processor, idempotency service, update-cost route, ingest proxy, Slack dispatch, credential service, execution core, storage service, webhook execution (384 tests).
• biome on the changed files. Nothing in the infra repo (metric filters, dashboards, canaries) reads any of the changed messages or modules.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)