Implement per-module log levels, which were documented and were a no-op

log-configure! modules: stored an alist that nothing ever read, and no log call had any way to name a module, so the feature was inert while the module docstring and README both advertised it. The estate recorded this on 2026-08-11 and it still re-entered a task brief on 2026-08-24, taken from the docstring by someone who had no reason to doubt it.

I implemented it rather than striking the docs, for three reasons:

• the promise already in the public API (modules: keyed by name) needed only a way for a call to name its module to become true;
• the consequence is live -- the Slate node put terminal byte I/O at trace because the global level is the only working volume control, so an operator who wants trace for ONE subsystem gets every byte of every terminal;
• the alternative convention, deriving a module from a subsystem/operation message prefix, is implicit, undocumented, breaks for messages with no prefix, and silently changes filtering when someone rewords a message. That is a worse trap than the one being fixed.

HOW A CALL NAMES ITS MODULE. By a module: field:

    (log-configure! level: 'info modules: '(("node/tty" . trace)))
    (log-trace* "byte in" module: "node/tty" n: 1)   ; emitted
    (log-trace* "byte out" module: "node/net")       ; suppressed
    (log-debug* "cache hit" key: "user:42")          ; suppressed, names no module

A call with no module: field always uses the global level, so nothing that exists today changes behaviour. The field is still emitted, so a line says which module it came from. Names may be strings or symbols.

THE HARD PART IS THE LAZY MACROS, and a naive implementation passes every other arm while failing the only one that matters. log-trace* expands to a guard evaluated BEFORE anything knows which module is being logged, so gating it on the global level makes a raised module unreachable through exactly the call style the library recommends. The guard is therefore log-level-may-be-active?, a conservative pre-filter that is true if the level passes the global level OR any configured module level; do-log then makes the exact per-module decision. It is computed fresh from the module alist on each call rather than cached, so it cannot go stale against a reconfiguration.

That predicate is exported because the macros expand into it at the call site. Application code wants log-level-active?, which now takes an optional module name and keeps its old meaning without one.

THE COST, asserted in a test rather than left to be discovered: raising ANY module to level N makes the argument expressions of EVERY level-N lazy call evaluate, even where the call is then suppressed. When no modules are configured -- the default -- laziness is exactly as before, and do-log keeps its original fast path.

Sabotage-tested, restores verified by sha256:

• product layer -- reverting the library to the previous commit turns 9 of the 15 module arms red;
• the discriminating control -- planting the NAIVE implementation (lazy macros gated on log-level-active?, everything else kept) turns the LAZY arm red and leaves the EAGER arm green, which is what shows that arm is doing real work rather than restating its neighbour.