fix(server): surface cloudflared FTL/PNC relay logs as warnings, not debug (#5076)

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: arhxam

apps/server/src/cloud/ManagedEndpointRuntime.test.ts

@@ -96,6 +96,15 @@ describe("CloudManagedEndpointRuntime", () => {
         "2026-06-17T02:00:00Z INF Starting metrics server",
       ),
     ).toBe("debug");
+    // FTL (fatal) and PNC (panic) are more severe than ERR and must surface.
+    expect(
+      ManagedEndpointRuntime.classifyRelayClientOutput(
+        "2026-06-17T02:00:00Z FTL Cannot determine default origin certificate path",
+      ),
+    ).toBe("warning");
+    expect(
+      ManagedEndpointRuntime.classifyRelayClientOutput("2026-06-17T02:00:00Z PNC runtime panic"),
+    ).toBe("warning");
   });
 
   it.effect("starts, deduplicates, rotates, and stops the Cloudflare connector", () =>

apps/server/src/cloud/ManagedEndpointRuntime.ts

@@ -72,7 +72,10 @@ export function classifyRelayClientOutput(line: string): "connected" | "warning"
   if (/\bRegistered tunnel connection\b/iu.test(line)) {
     return "connected";
   }
-  return /\b(?:ERR|WRN)\b/u.test(line) ? "warning" : "debug";
+  // cloudflared uses zerolog level tokens. FTL (fatal) and PNC (panic) are more
+  // severe than ERR, so they must surface at least as loudly — without them a
+  // fatal connector failure would be logged at debug and hidden.
+  return /\b(?:ERR|WRN|FTL|PNC)\b/u.test(line) ? "warning" : "debug";
 }
 
 function runtimeConfigKey(config: RelayManagedEndpointRuntimeConfig): string {