fix: logging verbosity now actually applies + per-service log levels

Root causes fixed:
- Dead LOG_LEVEL globals() lookup pinned root logger at INFO regardless of
  PIC_LOG_LEVEL env or config; replaced with _resolve_root_log_level() +
  apply_root_log_level() which sets both root logger and all attached handlers
  at startup and on runtime re-apply.
- set_service_level() only set the named 'pic.<service>' logger; bare module
  loggers (e.g. 'caddy_manager') were never reached, so per-service log files
  stayed 0 bytes. Fixed via _SERVICE_MODULE_LOGGERS map covering all managers.
- Log viewer GET /api/logs had no level filter; added ?level= query param.
- Per-service log levels lived in an out-of-band config/api/log_levels.json
  side-file with no validation; migrated into ConfigManager under a new
  'logging' section ({python:{root,services}, containers:{caddy,coredns,
  wireguard,mailserver,api}}) with get/set helpers, invalid-level rejection,
  and one-time migration from the old file on first load.

New capabilities:
- Container log levels: Caddy (injects global log { level X } + hot reload),
  CoreDNS (DEBUG enables log plugin, else errors-only), WireGuard/mailserver
  via pending_restart path.
- PUT /api/logs/verbosity accepts {python, containers} dict; returns per-entry
  applied:hot|pending_restart status.
- Webui Logs page gains two-section Verbosity tab (Python services + Container
  services) with needs-restart badges.
- managers.py wires per-service loggers before manager instantiation and
  re-applies persisted levels from ConfigManager; legacy log_levels.json read
  removed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/test_routes_services_catalog.py

@@ -616,25 +616,31 @@ class TestGetLogFiles:
 
 class TestGetLogVerbosity:
     def test_returns_200(self, client):
-        mock_lm = MagicMock()
-        mock_lm.get_service_levels.return_value = {'network': 'INFO'}
-        with patch.object(app_module, 'log_manager', mock_lm):
+        mock_cm = MagicMock()
+        mock_cm.get_logging_config.return_value = {
+            'python': {'root': 'INFO', 'services': {'network': 'INFO'}},
+            'containers': {'caddy': 'INFO'},
+        }
+        with patch.object(app_module, 'config_manager', mock_cm):
             resp = client.get('/api/logs/verbosity')
         assert resp.status_code == 200
 
-    def test_returns_service_levels(self, client):
-        mock_lm = MagicMock()
-        mock_lm.get_service_levels.return_value = {'network': 'DEBUG', 'email': 'INFO'}
-        with patch.object(app_module, 'log_manager', mock_lm):
+    def test_returns_python_and_container_sections(self, client):
+        mock_cm = MagicMock()
+        mock_cm.get_logging_config.return_value = {
+            'python': {'root': 'INFO', 'services': {'network': 'DEBUG', 'email': 'INFO'}},
+            'containers': {'caddy': 'WARNING'},
+        }
+        with patch.object(app_module, 'config_manager', mock_cm):
             resp = client.get('/api/logs/verbosity')
         data = json.loads(resp.data)
-        assert data['network'] == 'DEBUG'
-        assert data['email'] == 'INFO'
+        assert data['python']['services']['network'] == 'DEBUG'
+        assert data['containers']['caddy'] == 'WARNING'
 
     def test_500_on_exception(self, client):
-        mock_lm = MagicMock()
-        mock_lm.get_service_levels.side_effect = Exception('fail')
-        with patch.object(app_module, 'log_manager', mock_lm):
+        mock_cm = MagicMock()
+        mock_cm.get_logging_config.side_effect = Exception('fail')
+        with patch.object(app_module, 'config_manager', mock_cm):
             resp = client.get('/api/logs/verbosity')
         assert resp.status_code == 500
 
@@ -645,36 +651,37 @@ class TestGetLogVerbosity:
 
 class TestSetLogVerbosity:
     def test_returns_200(self, client):
-        import tempfile, os
-        mock_lm = MagicMock()
-        mock_lm.set_service_level.return_value = None
-        mock_lm.get_service_levels.return_value = {'network': 'DEBUG'}
-        with patch.object(app_module, 'log_manager', mock_lm):
-            with tempfile.TemporaryDirectory() as tmpdir:
-                with patch.dict(os.environ, {'CONFIG_DIR': tmpdir}):
-                    resp = client.put('/api/logs/verbosity',
-                                      data=json.dumps({'network': 'DEBUG'}),
-                                      content_type='application/json')
+        mock_cm = MagicMock()
+        mock_cm.get_logging_config.return_value = {
+            'python': {'root': 'INFO', 'services': {'network': 'DEBUG'}},
+            'containers': {},
+        }
+        with patch.object(app_module, 'config_manager', mock_cm), \
+             patch.object(app_module, 'log_manager', MagicMock()):
+            resp = client.put('/api/logs/verbosity',
+                              data=json.dumps({'python': {'services': {'network': 'DEBUG'}}}),
+                              content_type='application/json')
         assert resp.status_code == 200
 
-    def test_calls_set_service_level(self, client):
-        import tempfile, os
+    def test_persists_via_config_manager_and_applies_hot(self, client):
+        mock_cm = MagicMock()
+        mock_cm.get_logging_config.return_value = {'python': {}, 'containers': {}}
         mock_lm = MagicMock()
-        mock_lm.get_service_levels.return_value = {}
-        with patch.object(app_module, 'log_manager', mock_lm):
-            with tempfile.TemporaryDirectory() as tmpdir:
-                with patch.dict(os.environ, {'CONFIG_DIR': tmpdir}):
-                    client.put('/api/logs/verbosity',
-                               data=json.dumps({'network': 'DEBUG'}),
-                               content_type='application/json')
+        with patch.object(app_module, 'config_manager', mock_cm), \
+             patch.object(app_module, 'log_manager', mock_lm):
+            client.put('/api/logs/verbosity',
+                       data=json.dumps({'python': {'services': {'network': 'DEBUG'}}}),
+                       content_type='application/json')
+        mock_cm.set_python_log_level.assert_called_with('network', 'DEBUG')
         mock_lm.set_service_level.assert_called_with('network', 'DEBUG')
 
     def test_500_on_exception(self, client):
-        mock_lm = MagicMock()
-        mock_lm.set_service_level.side_effect = Exception('fail')
-        with patch.object(app_module, 'log_manager', mock_lm):
+        mock_cm = MagicMock()
+        mock_cm.set_python_log_level.side_effect = Exception('fail')
+        with patch.object(app_module, 'config_manager', mock_cm), \
+             patch.object(app_module, 'log_manager', MagicMock()):
             resp = client.put('/api/logs/verbosity',
-                              data=json.dumps({'network': 'DEBUG'}),
+                              data=json.dumps({'python': {'services': {'network': 'DEBUG'}}}),
                               content_type='application/json')
         assert resp.status_code == 500