fix: logging verbosity now actually applies + per-service log levels

Root causes fixed:
- Dead LOG_LEVEL globals() lookup pinned root logger at INFO regardless of
  PIC_LOG_LEVEL env or config; replaced with _resolve_root_log_level() +
  apply_root_log_level() which sets both root logger and all attached handlers
  at startup and on runtime re-apply.
- set_service_level() only set the named 'pic.<service>' logger; bare module
  loggers (e.g. 'caddy_manager') were never reached, so per-service log files
  stayed 0 bytes. Fixed via _SERVICE_MODULE_LOGGERS map covering all managers.
- Log viewer GET /api/logs had no level filter; added ?level= query param.
- Per-service log levels lived in an out-of-band config/api/log_levels.json
  side-file with no validation; migrated into ConfigManager under a new
  'logging' section ({python:{root,services}, containers:{caddy,coredns,
  wireguard,mailserver,api}}) with get/set helpers, invalid-level rejection,
  and one-time migration from the old file on first load.

New capabilities:
- Container log levels: Caddy (injects global log { level X } + hot reload),
  CoreDNS (DEBUG enables log plugin, else errors-only), WireGuard/mailserver
  via pending_restart path.
- PUT /api/logs/verbosity accepts {python, containers} dict; returns per-entry
  applied:hot|pending_restart status.
- Webui Logs page gains two-section Verbosity tab (Python services + Container
  services) with needs-restart badges.
- managers.py wires per-service loggers before manager instantiation and
  re-applies persisted levels from ConfigManager; legacy log_levels.json read
  removed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

api/app.py

@@ -59,8 +59,18 @@ from legacy_cleanup import cleanup_legacy_builtin_containers
 # Context variable for request info
 request_context = contextvars.ContextVar('request_context', default={})
 
-# Set default log level and log file if not already defined
-LOG_LEVEL = globals().get('LOG_LEVEL', 'INFO')
+def _resolve_root_log_level():
+    """Resolve the root python log level from PIC_LOG_LEVEL env, then the
+    ConfigManager logging.python.root setting, defaulting to INFO."""
+    env_level = os.environ.get('PIC_LOG_LEVEL', '').strip().upper()
+    if env_level in ('DEBUG', 'INFO', 'WARNING', 'ERROR', 'CRITICAL'):
+        return env_level
+    try:
+        return config_manager.get_logging_config()['python']['root']
+    except Exception:
+        return 'INFO'
+
+LOG_LEVEL = _resolve_root_log_level()
 LOG_FILE = globals().get('LOG_FILE', 'picell.log')
 
 class ContextFilter(logging.Filter):
@@ -111,6 +121,23 @@ logging.basicConfig(
 )
 logger = logging.getLogger('picell')
 
+
+def apply_root_log_level(level=None):
+    """(Re)apply the root python log level at runtime.
+
+    Sets the ROOT logger level and every root handler level so that bare-module
+    loggers (e.g. firewall_manager, network_manager) — which log via
+    logging.getLogger(__name__) and propagate to root — are governed. When
+    ``level`` is None the level is re-resolved from env/ConfigManager.
+    """
+    resolved = (level or _resolve_root_log_level()).upper()
+    numeric = getattr(logging, resolved, logging.INFO)
+    root = logging.getLogger()
+    root.setLevel(numeric)
+    for h in root.handlers:
+        h.setLevel(numeric)
+    return resolved
+
 # Flask app setup
 app = Flask(__name__)
 CORS(app,