feat(guard): collect AJAX/fetch requests instead of disabling the toolbar

Motivation

The guard currently disables the toolbar entirely for AJAX requests (layer 4) — precisely the requests that matter most in SPA-like parts of an application. The data exists server-side; only the delivery path is missing.

Concept (to be settled first)

Introduce a third guard state, "collect, don't render": for AJAX requests in a development environment, collectors run but no HTML is injected. Collected data is persisted into the existing request history. The server→history handoff is the central design question — options include a history store keyed by request that the next rendered page picks up, or polling from the toolbar frontend. Settle this in the issue before implementation.

Scope

• Guard refactoring: state instead of bool. BC-safe: GuardInterface::isEnabled() stays; a new method with a default implementation carries the third state.
• Collector lifecycle for non-rendering requests.
• History integration and frontend display of AJAX entries (grouped by page).

Explicitly out of scope

Any change to the fail-closed environment gate. Production behavior is untouched — in non-development environments nothing is collected, exactly as before.

Acceptance criteria

• AJAX requests appear in the history panel with full collector data (queries, timings, exceptions).
• Zero HTML injected into AJAX responses.
• Production behavior byte-identical to today.
• The guard concept and the chosen handoff mechanism documented in the README.

Start by settling the guard state and server-to-history handoff described in the issue before implementation. Then trace the existing guard, collector lifecycle, request history, and toolbar frontend components; use the acceptance criteria as the definition of done, including README documentation and unchanged production behavior.