Fix user-context collection, split agent log destinations, widen upload cap

Mapped drives stopped reporting because the user-context path failed silently
in three separate places, and none of them left a trace to read back.

- Probe: launch via -EncodedCommand instead of staging a temp .ps1 and running
  powershell.exe -File. A missing or quarantined script file fails BEFORE any
  statement runs, so the script's own try/catch never sees it and the only
  symptom is exit -196608.
- Spool: pin to the ShopFloor profile. Resolving it through WTSQueryUserToken
  is privileged, endpoint protection blocks it, and on failure the tray
  (writer) and service (reader) silently disagree about the path.
- Spool: consume after a successful parse, so a stopped tray cannot keep
  re-reporting stale mapped drives as current. Unparseable files are left in
  place for the next cycle.
- Logging: user-session components cannot write to Program Files or to the
  SYSTEM-owned ProgramData log directory, and the file sink degrades to a
  silent no-op when it cannot create its directory. Tray and probe now log to
  C:\Users\ShopFloor\ShopDB\Logs, installs transcript to ProgramData, and the
  sink records a SinkProblem instead of swallowing UnauthorizedAccessException.
- Installer: provision the operator spool/log directories with ShopFloor:Modify
  before the tray first runs, and stop the transcript via trap so a throw
  cannot orphan exactly the failed install worth reading.
- Upload cap 64 -> 128 MB: the self-contained tray publishes at ~69 MB and was
  rejected on SIZE, but the size check returns before the PE is parsed, so the
  operator only ever saw a version-detection failure.

AGENT-CONTRACT.md gains a normative section defining the three security
contexts, their log destinations, the fixed spool path and consume-on-read.

Agent 1.8.0 -> 1.8.1, tray 1.1.0 -> 1.1.1 so the deployed build is
identifiable from a log line.

plugins/endpoints/plugin.py

@@ -507,7 +507,66 @@ class EndpointsPlugin(BasePlugin):
                 ],
                 'empty': 'No network interfaces reported.',
                 'position': 16,
-                # adapter state is watched, not something you act on
+                # adapter state is watched, not something you act on.
+                # Declared in monitors but RENDERED at the top of the Details
+                # tab (PCDetail.vue lifts it by id and excludes it here): which
+                # adapter is up and what address it holds is asked at the same
+                # moment as "what is this box".
+                'group': 'monitors',
+            },
+            {
+                # What this box has been on the network, carved out of the
+                # hand-written Network card that used to sit on Details and
+                # show only current addresses with a Primary badge.
+                #
+                # The history is ACCIDENTAL: _record_interfaces matches on MAC
+                # then IP and never deletes, so old addresses accumulate. That
+                # turned out to be worth reading rather than worth cleaning
+                # away, so it is presented as what it already is.
+                'id': 'endpoints-iphistory',
+                'title': 'IP History',
+                'assettypes': ['computer'],
+                'endpoint': '/api/endpoints/asset/{assetid}/iphistory',
+                'render': 'table',
+                'collapsible': True,
+                'columns': [
+                    {'key': 'ipaddress', 'label': 'IP address', 'mono': True},
+                    {'key': 'macaddress', 'label': 'MAC', 'mono': True},
+                    {'key': 'status', 'label': 'Status'},
+                    {'key': 'firstseen', 'label': 'First seen',
+                     'format': 'date'},
+                    # NOT "last seen": modifieddate only moves when a field on
+                    # the row changes, so an address still held and reported
+                    # unchanged keeps an old stamp here.
+                    {'key': 'lastchanged', 'label': 'Last changed',
+                     'format': 'date'},
+                ],
+                'empty': 'No addresses on record for this endpoint.',
+                'position': 16.5,
+                'group': 'monitors',
+            },
+            {
+                # The other half of the old Network card: how each address is
+                # configured. Split from history because one table carrying
+                # both would be eleven columns wide, and the two answer
+                # different questions - what has this box been, versus how is
+                # this address set up.
+                'id': 'endpoints-ipconfig',
+                'title': 'IP Configuration',
+                'assettypes': ['computer'],
+                'endpoint': '/api/endpoints/asset/{assetid}/ipconfig',
+                'render': 'table',
+                'collapsible': True,
+                'columns': [
+                    {'key': 'ipaddress', 'label': 'IP address', 'mono': True},
+                    {'key': 'subnetmask', 'label': 'Subnet mask', 'mono': True},
+                    {'key': 'gateway', 'label': 'Gateway', 'mono': True},
+                    {'key': 'dns1', 'label': 'DNS 1', 'mono': True},
+                    {'key': 'dns2', 'label': 'DNS 2', 'mono': True},
+                    {'key': 'assignment', 'label': 'Assignment'},
+                ],
+                'empty': 'No addressing configuration on record.',
+                'position': 16.6,
                 'group': 'monitors',
             },
             {