Log store write failures at the source; share the oper guard

The store's map_err(|_| Internal) discarded the real IO error, so a
disk-full or permissions failure was invisible; log it once in the log
append path where it happens. Add echo_api::require_oper (parameterised
by the required privilege) and route the three copied per-service guards
through it, keeping each service's own wording and policy.

src/engine/db/mod.rs

@@ -690,7 +690,12 @@ impl EventLog {
         } else {
             LogEntry { origin: self.origin.clone(), seq: 0, lamport: 0, event }
         };
-        self.persist(&entry)?;
+        if let Err(e) = self.persist(&entry) {
+            // Surface the real cause (disk full, permissions, ...) here at the
+            // source; callers only see a generic Internal error further up.
+            tracing::error!(%e, path = %self.path.display(), "failed to write event to the log");
+            return Err(e);
+        }
         if global {
             self.versions.insert(entry.origin.clone(), entry.seq);
             self.notify(&entry);