auto-log: fetch failing-job log from Gitea API into the details block

New optional inputs (all default to off / safe):
  - auto-log: when true and details is empty, fetch and render the run's
    failing-job log via /api/v1/repos/<repo>/actions/jobs/<id>/logs.
  - token: defaults to github.token (per-run, repo-scoped). Overridable.
  - log-lines: tail-length fallback when no ::error:: annotation present.

Selection heuristic: if any line has ::error::, return those + 12 lines of
context above each (merged windows). Otherwise the last `log-lines` lines.
Timestamp prefixes (act_runner's leading ISO-8601 + Z) are stripped.

The details block already existed; this just makes it cheap for failure
emails to surface the actual build error inline instead of forcing the
reader to click "view run →".

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

README.md

@@ -37,6 +37,25 @@ With richer context:
     from: agent-ci@fritzlab.net
 ```
 
+Auto-include the actual build error from the failing step in the email body:
+
+```yaml
+- name: notify on failure
+  if: failure()
+  uses: https://code.fritzlab.net/action/notify-email@v1
+  with:
+    status: failure
+    summary: "latchkey build failed"
+    auto-log: 'true'
+    # token defaults to ${{ github.token }} which has read access to the
+    # current repo's actions; no caller-side config needed
+```
+
+`auto-log` fetches the run's failing-job log via the Gitea API, surfaces the
+`::error::` annotation context (or the last 40 lines if there isn't one),
+strips the runner's timestamp prefixes, and renders it in the details block.
+Skipped if `details:` is already set (manual takes precedence).
+
 Success notification (e.g. confirm a base-image rebuild cascaded):
 
 ```yaml
@@ -55,6 +74,9 @@ Success notification (e.g. confirm a base-image rebuild cascaded):
 | `status` | no | `info` | `failure` / `success` / `info` — drives accent colour + subject prefix. |
 | `subject` | no | `summary` | Mail subject after the status prefix. |
 | `details` | no | — | Multiline preformatted block, rendered in a monospace card. |
+| `auto-log` | no | `false` | When `true` and `details` is empty, fetch the failing-job log via the Gitea API and render its error context. |
+| `token` | no | `${{ github.token }}` | Gitea API token used for `auto-log`. The per-run GITHUB_TOKEN normally suffices. |
+| `log-lines` | no | `40` | Tail length used by `auto-log` when no `::error::` annotation is found. |
 | `to` | no | `noc@fritzlab.net` | Recipient address. |
 | `from` | no | `ci@fritzlab.net` | Sender address. Must be permitted by the relay. |
 | `smtp-host` | no | `mail.fritzlab.net` | SMTP relay host. |