Do we have, or need, a mechanism to rotate and purge these logs? There will be no IP's (since it's a hidden service), but the timestamp data could be useful, as could the contents of any errors.

I would recommend rotating logs every 8-24 hours and purging the old logs. They should be removed with srm, or stored in an encrypted container, or we should be using FDE (preferable).