feat(platform): tini as PID 1, Hypercorn, a log-level setting, the image on CI's Python, an airgapped boot gate before push (#5159)

- Dockerfile: python:3.14-slim, the Python CI tests on (was 3.13). tini from
  apt is PID 1 (ENTRYPOINT tini -- entrypoint.sh): it reaps the zombies ssh
  and ansible leave and forwards SIGTERM.
- cli: Hypercorn's serve() with one worker (run, stream and scheduler state is
  in-process), a 10 s graceful timeout, and SIGTERM/SIGINT as the shutdown
  trigger. Access and error lines go through Steward's logging. --debug keeps
  Quart's reloading dev server.
- Logging: steward/core/logging_setup.py installs one root handler before
  anything logs (until now a library's basicConfig on import was the only
  configuration). Its level is the `log.level` setting (DEBUG/INFO/WARNING/
  ERROR, default INFO), applied at boot and on save in Settings → General.
- CI publish: build, then "The image boots with no internet" (rule 164,
  snippet #3552), then push, so a broken image never reaches a tag (rule 177).
  On an --internal network with its own Postgres, the image must migrate and
  answer /health, run tini as PID 1, serve first-run setup with its assets
  from /static and no third-party host, and exit 0 on SIGTERM. Logs and
  clean-up run always.

Tests: tests/core/test_logging_setup.py; the smoke step itself.
Not in this commit: the dependency lockfile (it conflicts with rule 154 and
is waiting on the operator).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/core/logging_setup.py

@@ -0,0 +1,37 @@
+"""Steward's logging: one handler on the root logger, its level a setting (#5159).
+
+Until this, nothing in Steward configured logging. Lines reached the container
+log only because a library called basicConfig on import, so the level and the
+format were whatever that library chose. configure_logging runs first thing in
+the CLI, so a later basicConfig anywhere is a no-op. The level is the
+`log.level` setting, applied once settings load and again when it is saved.
+"""
+from __future__ import annotations
+
+import logging
+import sys
+
+LEVELS = ("DEBUG", "INFO", "WARNING", "ERROR")
+DEFAULT_LEVEL = "INFO"
+FORMAT = "%(asctime)s %(levelname)s [%(name)s] %(message)s"
+
+
+def set_log_level(level: object) -> str:
+    """Set the root level; an unknown value falls back to INFO. Returns the
+    level applied."""
+    name = str(level or "").strip().upper()
+    if name not in LEVELS:
+        name = DEFAULT_LEVEL
+    logging.getLogger().setLevel(name)
+    return name
+
+
+def configure_logging(level: object = DEFAULT_LEVEL) -> str:
+    """Install Steward's handler on the root logger (once) and set its level."""
+    root = logging.getLogger()
+    if not any(getattr(h, "_steward", False) for h in root.handlers):
+        handler = logging.StreamHandler(sys.stderr)
+        handler.setFormatter(logging.Formatter(FORMAT))
+        handler._steward = True  # type: ignore[attr-defined]
+        root.addHandler(handler)
+    return set_log_level(level)

steward/core/settings.py

@@ -53,6 +53,9 @@ DEFAULTS: dict[str, Any] = {
     # The audit log is a security record: kept longer than operational data.
     "audit.retention_days": 365,
     "monitors.poll_interval_seconds": 60,
+    # Root log level: DEBUG, INFO, WARNING or ERROR (steward/core/logging_setup.py).
+    # WARNING also hides the per-request access lines.
+    "log.level": "INFO",
     "smtp.host": "",
     "smtp.port": 587,
     "smtp.tls": True,