fix: a log that cannot be written does not fail the request

[blaipr]

LoggerBase::update() — the file/syslog receiver — has no guard around its body. Its three siblings
all have one:

receiver	guarded	attached
DatabaseHandler	catch (Exception) → processException()	only when isLogEnabled()
MailEvent	catch (Exception) → processException()	only when isMailEnabled()
NotificationEvent	catch (Exception) → processException()	conditionally
LoggerBase	nothing	every request, before the install check, no flag

So it is the one receiver that always runs and the one that cannot fail safely.

Monolog's StreamHandler throws when var/syspass.log cannot be opened or appended to — a full
disk, or permissions on var/. EventDispatcher::notify() is always called after the work it
describes, so that exception propagates out of an operation that has already completed.
Router catches it at the top and turns it into a generic error response, which means: the
administrator is told a master-password rotation failed when it had already finished. That is the
one outcome that must never be ambiguous — the whole reason the rotation writes its hash inside the
transaction.

unsetAppLocales() was also skipped on that path, leaving the request's locale set.

The change

The body moves into a private writeEvent(), and update() wraps it the way the siblings do, with
a finally so the locale is restored either way.

Two deliberate differences from the siblings:

• Throwable, not Exception — a stream failure can surface as an Error, and
  processException() accepts either.
• processException() is safe to call from here, which is worth stating because it looks
  circular: logger() writes with a suppressed file_put_contents() and falls back to
  error_log(), so it does not come back through Monolog and cannot throw again.

Test

testAFailingLoggerDoesNotFailTheRequest makes the injected logger throw and asserts update()
returns — and that unsetAppLocales() still ran, which a plain try/catch around the call would
have missed.

Mutation-verified: reverting src/ lets the RuntimeException escape the test as an error.

Not changed

That this receiver is attached unconditionally, while the other two are config-gated, is left alone:
the file log is the one that has to work before the database and the config are usable, which is why
it is attached first. The defect was that it could not fail safely, not that it runs.