fix: address Copilot review on #64

- Serialize log-source saves so a slow/failing earlier request can't
  revert UI state after a later request has already succeeded with
  overlapping state. saveLogSourcesNow now chains onto the previous
  save's settlement; the state being POSTed is read at dequeue time
  so any reverts done in an earlier caller's catch block are visible
  to the next save.
- Update GetEnabledLogSourcesByServerID doc comment — it still said
  "no HAProxy configuration" after the schema rename to boxes/box_id.

Author: sarg3nt

gearbox/internal/framework/database/log_sources.go

@@ -43,8 +43,9 @@ func (d *DB) GetEnabledLogSources(haproxyID int64) ([]LogSourceSetting, error) {
 	return sources, rows.Err()
 }
 
-// GetEnabledLogSourcesByServerID returns enabled log sources for a server by its server_id.
-// Returns empty slice (not error) if the server has no HAProxy configuration or no log sources.
+// GetEnabledLogSourcesByServerID returns enabled log sources for a box by its
+// box_id (the human-readable string identifier, e.g. "light-hugger").
+// Returns empty slice (not error) if no box matches or the box has no log sources.
 func (d *DB) GetEnabledLogSourcesByServerID(serverID string) ([]LogSourceSetting, error) {
 	d.mu.RLock()
 	defer d.mu.RUnlock()

gearbox/static/js/gears/logs-config.js

@@ -40,7 +40,22 @@
 			.map(input => input.value);
 	}
 
-	async function saveLogSourcesNow() {
+	// Serialize saves so a slow/failing earlier request can't revert UI state
+	// after a later request has already succeeded with overlapping state.
+	// Each call chains onto the previous save's settlement; the state being
+	// POSTed is read at dequeue time, so by the time a later save runs it
+	// sees any reverts the earlier save's caller performed in its catch block.
+	let saveQueue = Promise.resolve();
+
+	function saveLogSourcesNow() {
+		const next = saveQueue
+			.catch(() => {}) // don't let a prior rejection break the chain
+			.then(() => postLogSources());
+		saveQueue = next;
+		return next;
+	}
+
+	async function postLogSources() {
 		const root = document.getElementById('logs-config-root');
 		if (!root) return;
 		const url = root.dataset.saveUrl;