Adds 'sentry local', a long-running command that starts a minimal Hono
HTTP server wire-compatible with the Spotlight sidecar protocol. The
server uses @spotlightjs/spotlight/sdk's createSpotlightBuffer +
pushToSpotlightBuffer helpers to ingest envelopes from any Sentry SDK
running in the user's dev stack and tails them to the terminal.

Endpoints exposed:
  POST /stream                          - Spotlight ingest
  POST /api/{projectId}/envelope/       - Sentry SDK ingest path
  GET  /stream                          - SSE feed for the Spotlight overlay
  GET  /health                          - liveness check

Why a thin in-tree server instead of spawning npx @spotlightjs/spotlight:
the SDK helpers give us decompression + lazy parsing for free while
keeping the surface focused on a CLI-friendly tail UX, and bundling
through esbuild keeps the published binary self-contained per the
no-runtime-dependencies rule.

The command runs without auth (it's a local dev tool) and shuts down
gracefully on SIGINT/SIGTERM, force-closing keep-alive connections so
SSE subscribers don't block exit.

Replace the minimal 'timestamp • type' one-liner with rich formatted
output that shows actual event content: error type/message with stack
location, transaction name/op/duration/span count, and log messages
with attributes. Uses the CLI's own color system since Spotlight's
humanFormatters aren't publicly exported from the package.

- Remove logger tag so 'local <timestamp>' no longer clutters every line
- Remove 'Spotlight sidecar' wording, use 'Listening on <url>' instead
- Remove endpoint listing and DSN instructions from banner
- Add Spotlight docs link for getting started
- Auto-increment port on EADDRINUSE (up to 10 attempts)

- Remove pointless `log = logger` alias; use `logger` directly
- Strip narrating comments that restate the code
- Rename buildSidecarApp → buildApp; drop remaining 'sidecar' references
- Make onEnvelope callback optional instead of passing noop
- Remove redundant type annotation on activeFilters

The wildcard origin allowed any webpage to connect to the SSE stream
and exfiltrate envelope data. Restrict to localhost/127.0.0.1 origins
which is sufficient for local dev stacks (Vite, Next, Astro, etc.).

- Type labels: uppercase, bracketed, padded — [ERROR]   [TRACE]   [INFO]
- Source labels: uppercase, bracketed, padded — [SERVER]  [BROWSER] [MOBILE]
- Source colors: match Spotlight Sentinel theme (mobile=blue)
- Log attributes: per-attribute brackets [key=value] [key=value]
- Update docs fragment example output to match

exception.values is ordered oldest→newest per the Sentry protocol,
so values[0] is the root cause. Use .at(-1) to display the outermost
exception, matching Sentry UI and Spotlight behavior.

@sentry/sqlish uppercases SQL keywords (e.g. "by" → "BY"), so
identifiers that happen to match keywords fail the strict equality
check. Compare lowercased strings instead.

…rigins

Returning a mismatched string still worked (browser blocks on mismatch)
but returning null correctly omits the Access-Control-Allow-Origin
header per Hono's CORS middleware API.

… control chars

- run: set process.exitCode directly instead of EXIT.GENERAL so
  callers can distinguish the child's error type.
- server: validate content-encoding header against known values
  before passing to pushToSpotlightBuffer.
- sanitize: strip C0 control characters (BEL, BS, etc.) in addition
  to ANSI escapes and newlines.

tryListen now reads the OS-assigned port from server.address() instead
of returning the original argument. run.ts builds spotlightUrl after
the server starts so the child process gets the correct URL.

…estamps

… separator

- Use ...args rest parameter (Stricli passes variadic positionals
  as individual params, not an array)
- Strip leading '--' separator that Stricli passes through

…n type

The buildCommand wrapper consumes the async generator internally, so
loader() returns a plain async function. Tests must spread args as
individual parameters (matching Stricli's variadic positional convention)
and await the Promise directly.

The reverse order can prevent the close callback from firing when
active SSE connections exist, causing the shutdown promise to hang.

- CORS: add [::1] to LOCALHOST_ORIGIN_RE so IPv6 dev stacks pass
  preflight.
- formatSingleLog: guard against null attribute entries before
  accessing v.value.
- run.ts: remove unused biome-ignore suppression.

Extend sanitize() to cover the C1 range (0x80-0x9F) which includes
raw 8-bit CSI/OSC/DCS introducers, and collapse NEL (U+0085) as a
line break.

…ze()

Add a pass to remove bidi marks (U+200E-200F, U+202A-202E, U+2066-2069)
that can reorder terminal output rendering.