fix: logging verbosity now actually applies + per-service log levels

Root causes fixed:
- Dead LOG_LEVEL globals() lookup pinned root logger at INFO regardless of
  PIC_LOG_LEVEL env or config; replaced with _resolve_root_log_level() +
  apply_root_log_level() which sets both root logger and all attached handlers
  at startup and on runtime re-apply.
- set_service_level() only set the named 'pic.<service>' logger; bare module
  loggers (e.g. 'caddy_manager') were never reached, so per-service log files
  stayed 0 bytes. Fixed via _SERVICE_MODULE_LOGGERS map covering all managers.
- Log viewer GET /api/logs had no level filter; added ?level= query param.
- Per-service log levels lived in an out-of-band config/api/log_levels.json
  side-file with no validation; migrated into ConfigManager under a new
  'logging' section ({python:{root,services}, containers:{caddy,coredns,
  wireguard,mailserver,api}}) with get/set helpers, invalid-level rejection,
  and one-time migration from the old file on first load.

New capabilities:
- Container log levels: Caddy (injects global log { level X } + hot reload),
  CoreDNS (DEBUG enables log plugin, else errors-only), WireGuard/mailserver
  via pending_restart path.
- PUT /api/logs/verbosity accepts {python, containers} dict; returns per-entry
  applied:hot|pending_restart status.
- Webui Logs page gains two-section Verbosity tab (Python services + Container
  services) with needs-restart badges.
- managers.py wires per-service loggers before manager instantiation and
  re-applies persisted levels from ConfigManager; legacy log_levels.json read
  removed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/test_logs_endpoints.py

@@ -79,6 +79,26 @@ class TestGetBackendLogs(unittest.TestCase):
         self.assertEqual(r.status_code, 500)
         self.assertIn('error', json.loads(r.data))
 
+    def test_get_logs_level_filter_returns_only_matching(self):
+        lines = [
+            json.dumps({'level': 'INFO', 'message': 'started'}) + '\n',
+            json.dumps({'level': 'ERROR', 'message': 'boom'}) + '\n',
+            json.dumps({'level': 'INFO', 'message': 'ok'}) + '\n',
+            json.dumps({'level': 'ERROR', 'message': 'kaboom'}) + '\n',
+        ]
+        m = mock_open(read_data=''.join(lines))
+        m.return_value.readlines = lambda: lines
+        with patch('app.auth_manager', MagicMock(spec=object)), \
+             patch('app.os.path.exists', return_value=True), \
+             patch('builtins.open', m):
+            r = self.client.get('/api/logs?level=ERROR')
+        self.assertEqual(r.status_code, 200)
+        out = json.loads(r.data)['log']
+        self.assertIn('boom', out)
+        self.assertIn('kaboom', out)
+        self.assertNotIn('started', out)
+        self.assertNotIn('"message": "ok"', out)
+
 
 class TestGetServiceLogs(unittest.TestCase):
     """GET /api/logs/services/<service>"""
@@ -309,49 +329,86 @@ class TestLogVerbosity(unittest.TestCase):
         app.config['TESTING'] = True
         self.client = app.test_client()
 
-    @patch('app.log_manager')
-    def test_get_verbosity_returns_200_with_levels_map(self, mock_lm):
-        mock_lm.get_service_levels.return_value = {
-            'dns': 'INFO',
-            'email': 'DEBUG',
-            'wireguard': 'WARNING',
+    @patch('app.config_manager')
+    def test_get_verbosity_returns_200_with_python_and_containers(self, mock_cm):
+        mock_cm.get_logging_config.return_value = {
+            'python': {'root': 'INFO', 'services': {'email': 'DEBUG', 'wireguard': 'WARNING'}},
+            'containers': {'caddy': 'INFO', 'coredns': 'DEBUG'},
         }
         r = self.client.get('/api/logs/verbosity')
         self.assertEqual(r.status_code, 200)
         data = json.loads(r.data)
-        self.assertIn('dns', data)
-        self.assertEqual(data['email'], 'DEBUG')
+        self.assertEqual(data['python']['services']['email'], 'DEBUG')
+        self.assertEqual(data['containers']['coredns'], 'DEBUG')
 
-    @patch('app.log_manager')
-    def test_get_verbosity_returns_500_on_exception(self, mock_lm):
-        mock_lm.get_service_levels.side_effect = Exception('config missing')
+    @patch('app.config_manager')
+    def test_get_verbosity_returns_500_on_exception(self, mock_cm):
+        mock_cm.get_logging_config.side_effect = Exception('config missing')
         r = self.client.get('/api/logs/verbosity')
         self.assertEqual(r.status_code, 500)
         self.assertIn('error', json.loads(r.data))
 
+    @patch('app.apply_root_log_level')
     @patch('app.log_manager')
-    def test_put_verbosity_returns_200_and_calls_set_level(self, mock_lm):
-        mock_lm.get_service_levels.return_value = {'dns': 'DEBUG'}
-        with tempfile.TemporaryDirectory() as tmpdir:
-            with patch('app.auth_manager', MagicMock(spec=object)), \
-                 patch.dict('os.environ', {'CONFIG_DIR': tmpdir}):
-                r = self.client.put(
-                    '/api/logs/verbosity',
-                    data=json.dumps({'dns': 'DEBUG'}),
-                    content_type='application/json',
-                )
+    @patch('app.config_manager')
+    def test_put_verbosity_python_applies_hot(self, mock_cm, mock_lm, mock_apply):
+        mock_cm.get_logging_config.return_value = {
+            'python': {'root': 'DEBUG', 'services': {'network': 'DEBUG'}},
+            'containers': {},
+        }
+        with patch('app.auth_manager', MagicMock(spec=object)):
+            r = self.client.put(
+                '/api/logs/verbosity',
+                data=json.dumps({'python': {'root': 'DEBUG', 'services': {'network': 'DEBUG'}}}),
+                content_type='application/json',
+            )
         self.assertEqual(r.status_code, 200)
-        mock_lm.set_service_level.assert_called_with('dns', 'DEBUG')
+        mock_cm.set_python_log_level.assert_any_call('network', 'DEBUG')
+        mock_cm.set_python_log_level.assert_any_call('root', 'DEBUG')
+        mock_lm.set_service_level.assert_called_with('network', 'DEBUG')
+        mock_apply.assert_called_with('DEBUG')
 
-    @patch('app.log_manager')
-    def test_put_verbosity_returns_500_on_exception(self, mock_lm):
-        mock_lm.set_service_level.side_effect = Exception('unknown service')
-        r = self.client.put(
-            '/api/logs/verbosity',
-            data=json.dumps({'unknown_svc': 'DEBUG'}),
-            content_type='application/json',
-        )
-        self.assertEqual(r.status_code, 500)
+    @patch('app.firewall_manager')
+    @patch('app.config_manager')
+    def test_put_verbosity_coredns_applies_hot(self, mock_cm, mock_fw):
+        mock_cm.get_logging_config.return_value = {'python': {}, 'containers': {'coredns': 'DEBUG'}}
+        mock_cm.get_internal_domain.return_value = 'cell'
+        with patch('app.auth_manager', MagicMock(spec=object)), \
+             patch('app.peer_registry', MagicMock(list_peers=lambda: [])), \
+             patch('app.cell_link_manager', MagicMock(list_connections=lambda: None)):
+            r = self.client.put(
+                '/api/logs/verbosity',
+                data=json.dumps({'containers': {'coredns': 'DEBUG'}}),
+                content_type='application/json',
+            )
+        self.assertEqual(r.status_code, 200)
+        data = json.loads(r.data)
+        self.assertEqual(data['applied']['coredns'], 'hot')
+        mock_fw.generate_corefile.assert_called_once()
+        mock_fw.reload_coredns.assert_called_once()
+
+    @patch('app.config_manager')
+    def test_put_verbosity_wireguard_returns_pending_restart(self, mock_cm):
+        mock_cm.get_logging_config.return_value = {'python': {}, 'containers': {'wireguard': 'DEBUG'}}
+        with patch('app.auth_manager', MagicMock(spec=object)):
+            r = self.client.put(
+                '/api/logs/verbosity',
+                data=json.dumps({'containers': {'wireguard': 'DEBUG'}}),
+                content_type='application/json',
+            )
+        self.assertEqual(r.status_code, 200)
+        self.assertEqual(json.loads(r.data)['applied']['wireguard'], 'pending_restart')
+
+    @patch('app.config_manager')
+    def test_put_verbosity_invalid_level_returns_400(self, mock_cm):
+        mock_cm.set_python_log_level.side_effect = ValueError('Invalid log level')
+        with patch('app.auth_manager', MagicMock(spec=object)):
+            r = self.client.put(
+                '/api/logs/verbosity',
+                data=json.dumps({'python': {'services': {'network': 'LOUD'}}}),
+                content_type='application/json',
+            )
+        self.assertEqual(r.status_code, 400)
         self.assertIn('error', json.loads(r.data))