Add pluggable logging hook to safe-crypto-lib (issue #184, PR A)

[dnovick]

Summary

• Adds safe-crypto-lib/crypto_log.hpp: a zero-dependency, opt-in logging hook
  • CryptoLogLevel enum (Debug/Info/Warn/Error/Off)
  • crypto_set_log_sink(fn, threshold) — register any callable once at startup; passing nullptr disables logging; default state is silent
  • crypto_log_enabled(level) — single relaxed atomic load for fast-path guarding of expensive message construction
  • crypto_log(level, msg) — emit; no-op when below threshold
  • crypto_log_detail::msg(op, k, v...) — helper building "op: k=N bytes" strings without <format>
• Instruments every public API wrapper across all operation headers with Debug entry/success traces and Error traces forwarding CryptoError::message() — _impl functions are completely untouched
• Covered operations: sha, hmac_generate/verify, aes256_gcm_encrypt/decrypt, chacha20_poly1305_encrypt/decrypt, symmetric_encrypt/decrypt, random_bytes, ecdsa_*, ecdh_*, rsa_oaep_*, rsa_pss_*, hkdf_derive/expand, generate_rsa_key, slh_dsa_*, ml_dsa_*, ml_kem_*
• Security: key material, IVs, and payload bytes are never included in any log message — only algorithm names and byte-count sizes

Test plan

• All existing lib tests pass (safe_crypto_lib_test — verified locally, all pass)
• Verify logging is silent by default (no sink registered = zero allocations on hot path)
• PRs B (spdlog CLI integration) and C (JSON config) follow

Closes part of #184

🤖 Generated with Claude Code

[dnovick]

Reviewed latest head 4519e82. I do not see a code blocker in this logging PR.

What I checked:

• crypto_log.hpp sink/threshold behavior and callsite coverage across the public wrappers.
• Debug messages log operation names and sizes/status only; I did not see key material, IV bytes, payload bytes, or shared-secret bytes being emitted.
• Error logging forwards existing CryptoError::message() strings.

Local verification:

• Configured PSA_MBEDTLS Debug build in /private/tmp/claude-crypto-pr185-build.
• Built safe_crypto_lib_test successfully.
• Ran ctest --test-dir /private/tmp/claude-crypto-pr185-build --output-on-failure -E safe_crypto_cli_test_NOT_BUILT: 495/495 passed.

GitHub CI is almost green: all reported jobs pass except ARM_ASM / Debug, which is still pending. I would wait for that final required check before merging.