fix: logging verbosity now actually applies + per-service log levels

Root causes fixed:
- Dead LOG_LEVEL globals() lookup pinned root logger at INFO regardless of
  PIC_LOG_LEVEL env or config; replaced with _resolve_root_log_level() +
  apply_root_log_level() which sets both root logger and all attached handlers
  at startup and on runtime re-apply.
- set_service_level() only set the named 'pic.<service>' logger; bare module
  loggers (e.g. 'caddy_manager') were never reached, so per-service log files
  stayed 0 bytes. Fixed via _SERVICE_MODULE_LOGGERS map covering all managers.
- Log viewer GET /api/logs had no level filter; added ?level= query param.
- Per-service log levels lived in an out-of-band config/api/log_levels.json
  side-file with no validation; migrated into ConfigManager under a new
  'logging' section ({python:{root,services}, containers:{caddy,coredns,
  wireguard,mailserver,api}}) with get/set helpers, invalid-level rejection,
  and one-time migration from the old file on first load.

New capabilities:
- Container log levels: Caddy (injects global log { level X } + hot reload),
  CoreDNS (DEBUG enables log plugin, else errors-only), WireGuard/mailserver
  via pending_restart path.
- PUT /api/logs/verbosity accepts {python, containers} dict; returns per-entry
  applied:hot|pending_restart status.
- Webui Logs page gains two-section Verbosity tab (Python services + Container
  services) with needs-restart badges.
- managers.py wires per-service loggers before manager instantiation and
  re-applies persisted levels from ConfigManager; legacy log_levels.json read
  removed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

api/log_manager.py

@@ -21,6 +21,20 @@ from enum import Enum
 
 logger = logging.getLogger(__name__)
 
+# Maps a verbosity-panel service name to the bare module logger(s) used by the
+# corresponding manager (logging.getLogger(__name__)). Managers log under BOTH
+# 'picell.<service>' (self.logger) and their module name, so a verbosity change
+# must reach both for per-service log files to capture everything.
+_SERVICE_MODULE_LOGGERS = {
+    'network':   ['network_manager'],
+    'wireguard': ['wireguard_manager'],
+    'email':     ['email_manager'],
+    'calendar':  ['calendar_manager'],
+    'files':     ['file_manager'],
+    'routing':   ['routing_manager', 'firewall_manager'],
+    'vault':     ['vault_manager'],
+}
+
 class LogLevel(Enum):
     """Log levels"""
     DEBUG = "DEBUG"
@@ -499,7 +513,13 @@ class LogManager:
             return {'error': str(e)}
     
     def set_service_level(self, service: str, level: str):
-        """Change log level for a service at runtime."""
+        """Change log level for a service at runtime.
+
+        Sets BOTH the 'picell.<service>' logger (self.logger in managers) AND the
+        bare module logger(s) the manager uses via logging.getLogger(__name__),
+        so the change reaches every record a service emits — not just the half
+        that goes through self.logger.
+        """
         try:
             log_level = getattr(logging, level.upper(), logging.INFO)
             if service in self.service_loggers:
@@ -509,6 +529,8 @@ class LogManager:
                 logger.info(f"Set log level for {service} to {level}")
             else:
                 logger.warning(f"Service logger not found: {service}")
+            for module_name in _SERVICE_MODULE_LOGGERS.get(service, []):
+                logging.getLogger(module_name).setLevel(log_level)
         except Exception as e:
             logger.error(f"Error setting log level for {service}: {e}")