fix: logging verbosity now actually applies + per-service log levels

Root causes fixed:
- Dead LOG_LEVEL globals() lookup pinned root logger at INFO regardless of
  PIC_LOG_LEVEL env or config; replaced with _resolve_root_log_level() +
  apply_root_log_level() which sets both root logger and all attached handlers
  at startup and on runtime re-apply.
- set_service_level() only set the named 'pic.<service>' logger; bare module
  loggers (e.g. 'caddy_manager') were never reached, so per-service log files
  stayed 0 bytes. Fixed via _SERVICE_MODULE_LOGGERS map covering all managers.
- Log viewer GET /api/logs had no level filter; added ?level= query param.
- Per-service log levels lived in an out-of-band config/api/log_levels.json
  side-file with no validation; migrated into ConfigManager under a new
  'logging' section ({python:{root,services}, containers:{caddy,coredns,
  wireguard,mailserver,api}}) with get/set helpers, invalid-level rejection,
  and one-time migration from the old file on first load.

New capabilities:
- Container log levels: Caddy (injects global log { level X } + hot reload),
  CoreDNS (DEBUG enables log plugin, else errors-only), WireGuard/mailserver
  via pending_restart path.
- PUT /api/logs/verbosity accepts {python, containers} dict; returns per-entry
  applied:hot|pending_restart status.
- Webui Logs page gains two-section Verbosity tab (Python services + Container
  services) with needs-restart badges.
- managers.py wires per-service loggers before manager instantiation and
  re-applies persisted levels from ConfigManager; legacy log_levels.json read
  removed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

api/routes/services.py

@@ -332,40 +332,89 @@ def get_log_file_infos():
         logger.error(f"Error listing log files: {e}")
         return jsonify({"error": str(e)}), 500
 
+# Container-ENV driven services need a container recreate before a level change
+# takes effect (the others — caddy/coredns/api — apply hot).
+_RESTART_CONTAINERS = {'wireguard', 'mailserver'}
+
+
 @bp.route('/api/logs/verbosity', methods=['GET'])
 def get_log_verbosity():
+    """Return both the python (per-service + root) and container log levels."""
     try:
-        from app import log_manager
-        return jsonify(log_manager.get_service_levels())
+        from app import config_manager
+        return jsonify(config_manager.get_logging_config())
     except Exception as e:
         logger.error(f"Error getting log verbosity: {e}")
         return jsonify({"error": str(e)}), 500
 
+
 @bp.route('/api/logs/verbosity', methods=['PUT'])
 def set_log_verbosity():
+    """Update python and/or container log levels.
+
+    Payload: {"python": {"root": "DEBUG", "services": {...}}, "containers": {...}}
+    Python levels apply hot to the running API. Container levels regenerate the
+    relevant config and hot-reload (caddy/coredns) or are queued for the next
+    container recreate (wireguard/mailserver). Returns an `applied` map of
+    "hot" | "pending_restart" per container entry.
+    """
     try:
-        from app import log_manager
+        from app import config_manager, log_manager, apply_root_log_level
         data = request.get_json(silent=True) or {}
-        for service, level in data.items():
+        python = data.get('python', {}) or {}
+        containers = data.get('containers', {}) or {}
+
+        applied = {}
+
+        services = python.get('services', {}) or {}
+        for service, level in services.items():
+            config_manager.set_python_log_level(service, level)
             log_manager.set_service_level(service, level)
-        _config_dir = os.environ.get('CONFIG_DIR', '/app/config')
-        levels_file = os.path.join(_config_dir, 'log_levels.json')
-        os.makedirs(os.path.dirname(levels_file), exist_ok=True)
-        current = {}
-        if os.path.exists(levels_file):
-            try:
-                with open(levels_file) as f:
-                    current = json.load(f)
-            except Exception:
-                pass
-        current.update(data)
-        with open(levels_file, 'w') as f:
-            json.dump(current, f, indent=2)
-        return jsonify({"message": "Log levels updated", "levels": log_manager.get_service_levels()})
+
+        if 'root' in python:
+            config_manager.set_python_log_level('root', python['root'])
+            apply_root_log_level(python['root'])
+
+        for container, level in containers.items():
+            config_manager.set_container_log_level(container, level)
+            applied[container] = _apply_container_level(container)
+
+        return jsonify({
+            "message": "Log levels updated",
+            "logging": config_manager.get_logging_config(),
+            "applied": applied,
+        })
+    except ValueError as e:
+        return jsonify({"error": str(e)}), 400
     except Exception as e:
         logger.error(f"Error setting log verbosity: {e}")
         return jsonify({"error": str(e)}), 500
 
+
+def _apply_container_level(container: str) -> str:
+    """Apply a container's log level. Returns "hot" or "pending_restart"."""
+    if container == 'caddy':
+        from app import caddy_manager, config_manager
+        caddy_manager.regenerate_with_installed(
+            list(config_manager.get_installed_services().values())
+        )
+        return "hot"
+    if container == 'coredns':
+        from app import firewall_manager, peer_registry, config_manager, cell_link_manager
+        peers = peer_registry.list_peers() if peer_registry else []
+        cell_links = cell_link_manager.list_connections() if cell_link_manager else None
+        firewall_manager.generate_corefile(
+            peers, domain=config_manager.get_internal_domain(), cell_links=cell_links)
+        firewall_manager.reload_coredns()
+        return "hot"
+    if container == 'api':
+        # The API container's own root level is applied hot via apply_root_log_level
+        # when python.root changes; the container entry is informational.
+        return "hot"
+    if container in _RESTART_CONTAINERS:
+        return "pending_restart"
+    return "pending_restart"
+
 @bp.route('/api/services/status', methods=['GET'])
 def get_all_services_status():
     try:
@@ -467,12 +516,16 @@ def test_all_services_connectivity():
 def get_backend_logs():
     log_file = os.path.join(os.path.dirname(os.path.dirname(__file__)), 'picell.log')
     lines = int(request.args.get('lines', 100))
+    level = (request.args.get('level') or 'ALL').upper()
     try:
         if not os.path.exists(log_file):
             return jsonify({"error": "Log file not found."}), 404
         with open(log_file, 'r', encoding='utf-8', errors='ignore') as f:
             all_lines = f.readlines()
-            tail_lines = all_lines[-lines:] if lines > 0 else all_lines
+        if level != 'ALL':
+            from app import log_manager
+            all_lines = [ln for ln in all_lines if log_manager._is_log_level(ln, level)]
+        tail_lines = all_lines[-lines:] if lines > 0 else all_lines
         return jsonify({"log": ''.join(tail_lines)})
     except Exception as e:
         logger.error(f"Error reading log file: {e}")