feat(platform): tini as PID 1, Hypercorn, a log-level setting, the image on CI's Python, an airgapped boot gate before push (#5159)

- Dockerfile: python:3.14-slim, the Python CI tests on (was 3.13). tini from
  apt is PID 1 (ENTRYPOINT tini -- entrypoint.sh): it reaps the zombies ssh
  and ansible leave and forwards SIGTERM.
- cli: Hypercorn's serve() with one worker (run, stream and scheduler state is
  in-process), a 10 s graceful timeout, and SIGTERM/SIGINT as the shutdown
  trigger. Access and error lines go through Steward's logging. --debug keeps
  Quart's reloading dev server.
- Logging: steward/core/logging_setup.py installs one root handler before
  anything logs (until now a library's basicConfig on import was the only
  configuration). Its level is the `log.level` setting (DEBUG/INFO/WARNING/
  ERROR, default INFO), applied at boot and on save in Settings → General.
- CI publish: build, then "The image boots with no internet" (rule 164,
  snippet #3552), then push, so a broken image never reaches a tag (rule 177).
  On an --internal network with its own Postgres, the image must migrate and
  answer /health, run tini as PID 1, serve first-run setup with its assets
  from /static and no third-party host, and exit 0 on SIGTERM. Logs and
  clean-up run always.

Tests: tests/core/test_logging_setup.py; the smoke step itself.
Not in this commit: the dependency lockfile (it conflicts with rule 154 and
is waiting on the operator).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/cli.py

@@ -1,14 +1,56 @@
+import asyncio
+import logging
+import signal
 from pathlib import Path
+
 import click
-from .app import create_app
+
+from .core.logging_setup import configure_logging
+
+# How long a stop waits for requests in flight (and SSE streams) to finish.
+GRACEFUL_TIMEOUT_SECONDS = 10.0
+
+
+def hypercorn_config(host: str, port: int):
+    """Hypercorn as the production server (#5159): one worker, because Steward
+    keeps run, stream and scheduler state in-process; its access and error
+    lines go through Steward's logging, so the log.level setting governs them."""
+    from hypercorn.config import Config
+
+    config = Config()
+    config.bind = [f"{host}:{port}"]
+    config.workers = 1
+    config.graceful_timeout = GRACEFUL_TIMEOUT_SECONDS
+    config.accesslog = logging.getLogger("hypercorn.access")
+    config.errorlog = logging.getLogger("hypercorn.error")
+    config.access_log_format = "%(h)s %(r)s %(s)s %(b)s %(D)s"
+    return config
+
+
+async def _serve(app, config) -> None:
+    from hypercorn.asyncio import serve
+
+    stop = asyncio.Event()
+    loop = asyncio.get_running_loop()
+    for sig in (signal.SIGTERM, signal.SIGINT):
+        loop.add_signal_handler(sig, stop.set)
+    await serve(app, config, shutdown_trigger=stop.wait)
 
 
 @click.command()
 @click.option("--config", default="config.yaml", help="Path to config.yaml")
 @click.option("--host", default="0.0.0.0")
 @click.option("--port", default=5000, type=int)
-@click.option("--debug", is_flag=True, default=False)
+@click.option("--debug", is_flag=True, default=False,
+              help="Quart's development server with the reloader, not Hypercorn.")
 def main(config: str, host: str, port: int, debug: bool) -> None:
     """Start the Steward server."""
+    # Before anything logs; create_app applies the log.level setting once
+    # settings load.
+    configure_logging()
+    from .app import create_app
     app = create_app(config_path=Path(config))
-    app.run(host=host, port=port, debug=debug)
+    if debug:
+        app.run(host=host, port=port, debug=True)
+        return
+    asyncio.run(_serve(app, hypercorn_config(host, port)))