docs: document LinuxServer socket-proxy ALLOW_LOGS (#1848)

LinuxServer socket-proxy gates container logs behind ALLOW_LOGS. Document
those extras on top of every profile that includes log viewing, keep
archive/changes/export/top disabled, and point Editor and Global Logs
troubleshooting at the self-hosting section.

docs/features/editor.mdx

@@ -231,6 +231,9 @@ Sencho tries `/bin/bash` first and transparently falls back to `/bin/sh` if bash
   <Accordion title="The .env tab is greyed out">
     The stack has no env file to edit. Add an `env_file:` entry to a service in `compose.yaml` and save, or create a `.env` file in the stack directory through the **Files** tab.
   </Accordion>
+  <Accordion title='Log viewer shows "Request forbidden by administrative rules"'>
+    The container list can still load while log viewing fails. The **View logs** stream can show `[Sencho] Error fetching logs:` followed by an HTTP 403 and `Request forbidden by administrative rules`. A Docker socket proxy is blocking `/containers/{id}/logs`. On `linuxserver/socket-proxy`, set `ALLOW_LOGS=1` in addition to `CONTAINERS=1`. Tecnativa-style profiles include logs under `CONTAINERS`. See [Self-Hosting: Docker socket proxy](/operations/self-hosting#linuxserver-socket-proxy-extras).
+  </Accordion>
   <Accordion title="I can't edit compose from my phone">
     Open the **Compose** segment in the stack detail and tap **Edit compose**. If that affordance is missing, your role lacks the `stack:edit` permission; ask an admin to grant it. The phone editor is intended for small corrections; for large compose rewrites, open the stack on a desktop.
   </Accordion>

docs/features/global-observability.mdx

@@ -160,6 +160,9 @@ The page is built from several independent loops so the masthead and the sparkli
   <Accordion title="The masthead reads 'Offline' and a 'Failed to fetch logs. Retrying...' banner is visible">
     The polling fallback got an HTTP error when it tried to read `/api/logs/global`. Check that the host's Docker daemon is reachable on the socket Sencho is configured to use. The page retries the request every five seconds; once it succeeds, the banner clears on its own.
   </Accordion>
+  <Accordion title="The Logs feed stays empty while managed containers are running">
+    The page can stay connected (Streaming or Idle, no Offline masthead, no Failed to fetch logs banner) while the feed shows **Awaiting events** and container lines never arrive. A Docker socket proxy is allowing list and inspect but blocking `/containers/{id}/logs`. On `linuxserver/socket-proxy`, set `ALLOW_LOGS=1` in addition to `CONTAINERS=1`. See [Self-Hosting: Docker socket proxy](/operations/self-hosting#linuxserver-socket-proxy-extras).
+  </Accordion>
   <Accordion title="The masthead rail is gray and the state reads 'Idle' even though logs are appearing further down the page">
     `Idle` only checks whether an event has arrived in the last ten seconds. If your fleet is genuinely quiet (a maintenance window, a single low-traffic container), the rail rests gray and the band headers in the feed roll up to `2M AGO`, `5M AGO`, and so on. The next event flips the rail back to a shimmering brand cyan and the state word back to `Streaming` on the next one-second tick.
   </Accordion>

docs/operations/self-hosting.mdx

@@ -79,7 +79,7 @@ The second option matters because Sencho talks to Docker through two paths, and
 
 The last row is the exception to everything above. See [Self-update behind a proxy](#self-update-behind-a-proxy).
 
-The profiles below use `tecnativa/docker-socket-proxy` style flags as a worked example. Other proxies (for example `linuxserver/socket-proxy`) expose similar API-group flags, and the exact lifecycle allow flags vary by implementation, so check the flag names against the proxy image and version you run. Profile values are the literal strings `1` and `0`.
+The profiles below use `tecnativa/docker-socket-proxy` style flags as a worked example. Other proxies (for example `linuxserver/socket-proxy`) expose similar API-group flags; check the names against the image and version you run. Profile values are the literal strings `1` and `0`. If you run `linuxserver/socket-proxy`, add the [LinuxServer socket-proxy extras](#linuxserver-socket-proxy-extras) on top of any profile. Log viewing on that image requires `ALLOW_LOGS=1` in addition to `CONTAINERS=1`.
 
 Compose Doctor classifies socket-proxy topologies in-app and flags risky configurations such as a proxy that allows mutating API access, publishes a host port, or joins a non-internal network. See [Compose Doctor](/features/compose-doctor).
 
@@ -154,6 +154,26 @@ GRPC=1
 
 This profile supports the full Sencho surface: the interactive shell, build-backed stacks, helper containers, cleanup actions, and self-update where a usable host Docker socket path is available to helpers (see the caveat below).
 
+### LinuxServer socket-proxy extras
+
+When the proxy image is `linuxserver/socket-proxy` (or `lscr.io/linuxserver/socket-proxy`), add these flags on top of **any** profile above. All three profiles include log viewing.
+
+```env
+ALLOW_LOGS=1
+ALLOW_ARCHIVE=0
+ALLOW_CHANGES=0
+ALLOW_EXPORT=0
+ALLOW_TOP=0
+```
+
+On this image, `CONTAINERS=1` lists and inspects containers; it does not open `/containers/{id}/logs`. Sencho log viewing (the Editor **View logs** modal, stack log streams, and the hub Logs tab) requires `ALLOW_LOGS=1`. Enabling `POST` does not grant log access.
+
+If inventory still works but log viewing does not, the proxy is blocking that endpoint. A typical denial body is `403 Forbidden` with `Request forbidden by administrative rules`.
+
+Keep the other four flags at `0`. Sencho does not use the container archive, filesystem-diff, export, or `top` Engine endpoints.
+
+Tecnativa profiles do not use these keys. On `tecnativa/docker-socket-proxy`, logs stay under `CONTAINERS`.
+
 ### Keep these disabled
 
 Sencho does not use these API groups today. Keep them disabled unless a future feature adds a direct dependency:
@@ -175,7 +195,7 @@ DISTRIBUTION=0
 
 | Capability | What the proxy must allow |
 |------------|---------------------------|
-| Dashboard inventory, topology, logs, stats | CONTAINERS (list, inspect, logs, stats), IMAGES, NETWORKS, VOLUMES, INFO, SYSTEM (disk usage), EVENTS, PING, VERSION |
+| Dashboard inventory, topology, logs, stats | CONTAINERS (list, inspect, logs, stats), IMAGES, NETWORKS, VOLUMES, INFO, SYSTEM (disk usage), EVENTS, PING, VERSION. On `linuxserver/socket-proxy`, add `ALLOW_LOGS=1`. |
 | Container start, stop, restart, auto-heal | CONTAINERS plus POST plus the lifecycle allow flags |
 | Compose deploy, update, down, pull | POST plus the CONTAINERS, IMAGES, NETWORKS, and VOLUMES groups the Compose Engine uses through the same endpoint |
 | Build-backed stacks | BUILD plus SESSION and GRPC as the BuildKit path requires |