File the repair log settings under the section that documents them

They sat under AI Web Search, which only mattered once the settings card
started grouping by the header above a key.

Deployment/master.conf.template

@@ -1877,6 +1877,11 @@
 # Both are bounded by time (since the last pass) and by a line cap, so a flood costs one pass.
 # Tools/ai_log_check.sh replays this host's real logs against the patterns — run it after
 # changing any of them.
+    AI_REPAIR_SYSLOG_ENABLED=true
+    AI_REPAIR_SYSLOG_MAX_LINES=4000
+    AI_REPAIR_CONTAINER_LOGS_ENABLED=true
+    AI_REPAIR_CONTAINER_LOG_LINES=400
+
 # ━━━ AI Web Search ━━━
 # General Chat only. Every other profile either reads this installation or changes it; chat holds
 # no capability at all, and that is exactly why searching is the one thing it may do — a read that
@@ -1904,11 +1909,6 @@
     AI_WEB_SEARCH_RESULTS=4
     AI_WEB_SEARCH_TIMEOUT=6
 
-    AI_REPAIR_SYSLOG_ENABLED=true
-    AI_REPAIR_SYSLOG_MAX_LINES=4000
-    AI_REPAIR_CONTAINER_LOGS_ENABLED=true
-    AI_REPAIR_CONTAINER_LOG_LINES=400
-
 # ━━━ AI Conf Write Access ━━━
 # Separate switch from AI_ENABLED, off by default, and an explicit key whitelist. Never paths,
 # never credentials, never a container name. An empty whitelist means no writes regardless of