fix: logging verbosity now actually applies + per-service log levels

Root causes fixed:
- Dead LOG_LEVEL globals() lookup pinned root logger at INFO regardless of
  PIC_LOG_LEVEL env or config; replaced with _resolve_root_log_level() +
  apply_root_log_level() which sets both root logger and all attached handlers
  at startup and on runtime re-apply.
- set_service_level() only set the named 'pic.<service>' logger; bare module
  loggers (e.g. 'caddy_manager') were never reached, so per-service log files
  stayed 0 bytes. Fixed via _SERVICE_MODULE_LOGGERS map covering all managers.
- Log viewer GET /api/logs had no level filter; added ?level= query param.
- Per-service log levels lived in an out-of-band config/api/log_levels.json
  side-file with no validation; migrated into ConfigManager under a new
  'logging' section ({python:{root,services}, containers:{caddy,coredns,
  wireguard,mailserver,api}}) with get/set helpers, invalid-level rejection,
  and one-time migration from the old file on first load.

New capabilities:
- Container log levels: Caddy (injects global log { level X } + hot reload),
  CoreDNS (DEBUG enables log plugin, else errors-only), WireGuard/mailserver
  via pending_restart path.
- PUT /api/logs/verbosity accepts {python, containers} dict; returns per-entry
  applied:hot|pending_restart status.
- Webui Logs page gains two-section Verbosity tab (Python services + Container
  services) with needs-restart badges.
- managers.py wires per-service loggers before manager instantiation and
  re-applies persisted levels from ConfigManager; legacy log_levels.json read
  removed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/test_caddy_manager.py

@@ -735,5 +735,34 @@ class TestDdnsApiStripsLegacySuffix(unittest.TestCase):
         self.assertIn('api_base_url https://ddns.pic.ngo', out)
 
 
+class TestCaddyLogLevel(unittest.TestCase):
+    """Container log level injects a global `log { level <X> }` block."""
+
+    def _mgr_with_level(self, level):
+        cm = MagicMock()
+        cm.get_identity.return_value = {}
+        cm.get_logging_config.return_value = {
+            'python': {'root': 'INFO', 'services': {}},
+            'containers': {'caddy': level},
+        }
+        return CaddyManager(config_manager=cm, data_dir='/tmp/pic-t', config_dir='/tmp/pic-t')
+
+    def test_debug_emits_global_log_block_lan(self):
+        mgr = self._mgr_with_level('DEBUG')
+        out = mgr.generate_caddyfile({'cell_name': 'c', 'domain_mode': 'lan'}, [])
+        self.assertIn('log {', out)
+        self.assertIn('level DEBUG', out)
+
+    def test_info_emits_no_log_block(self):
+        mgr = self._mgr_with_level('INFO')
+        out = mgr.generate_caddyfile({'cell_name': 'c', 'domain_mode': 'lan'}, [])
+        self.assertNotIn('log {', out)
+
+    def test_warning_maps_to_caddy_warn(self):
+        mgr = self._mgr_with_level('WARNING')
+        out = mgr.generate_caddyfile({'cell_name': 'c', 'domain_mode': 'lan'}, [])
+        self.assertIn('level WARN', out)
+
+
 if __name__ == '__main__':
     unittest.main()