fix: stored logs keep bad rows, erased accounts and unconsented queries out

Deep-review round 1 of E22.

- A NUL character (`GET /assets/%00` logs the decoded path) made Postgres
  refuse the row and with it the sink's whole batch, every user's rows
  included. `to_row` replaces NUL in every text column and in attrs.
- An erased account's lines kept arriving after purge_user's DELETE: the
  erasing request's own access line, a queued row, a background task.
  `logs.forget_user` runs first; later rows are stored without the account,
  and the check and the insert share a lock with the erasure.
- An admin setting the whole process to TRACE logged every user's query
  string. The query is now logged only under the user's own Teljes consent,
  and decoded before redaction, so `%40` no longer hides an address.
- The browser log ingest has an hourly storage budget per account (5 MiB,
  one notice when spent) and reads only a JSON Content-Type, so a
  same-site text/plain form post cannot write into a user's log.
  RateLimiter takes a per-attempt cost for the byte budget.
- The root level is applied under the elevation lock: two concurrent
  changes could leave it at the base while an elevation was active.
- Tests for the running sink (level gate, drain on stop) and for the
  admin log level applied at runtime and at boot.

backend/app/logs.py

@@ -40,6 +40,7 @@ import time
 import uuid
 from datetime import datetime, timezone
 from typing import Any
+from urllib.parse import parse_qsl
 
 from app.config import settings
 from app.ratelimit import RateLimiter, client_key
@@ -204,6 +205,14 @@ def redact_text(text: str) -> str:
     return _EMAIL_RE.sub(REDACTED_EMAIL, scrubbed)
 
 
+def redact_query(query: str) -> str:
+    """Scrub a raw query string. DECODED first: the text rules match what was typed, and a browser
+    sends it percent-encoded — `someone%40example.com` is an address `_EMAIL_RE` cannot see. Each
+    parameter also goes through the key rules, so `?new_password=` goes as `redact` would drop it."""
+    pairs = parse_qsl(query, keep_blank_values=True)
+    return "&".join(redact_text(f"{key}={redact(value, key=key)}") for key, value in pairs)
+
+
 def redact(value: Any, *, key: str = "") -> Any:
     """Recursively scrub a structure destined for the log.
 
@@ -457,13 +466,57 @@ def _apply_root_level(force: bool = False) -> None:
     if _base_level == logging.NOTSET:
         return  # not configured: the root keeps whatever the process set up
     now = datetime.now(timezone.utc)
+    # The level is SET under the lock too, not just computed: two threads that each computed a
+    # different answer would otherwise apply them in either order, and the older one could win —
+    # the root back at the base while an elevation is still active.
     with _elevations_lock:
         for user_id in [u for u, (_, until) in _elevations.items() if until <= now]:
             del _elevations[user_id]
         lowest = min([_base_level, *(lvl for lvl, _ in _elevations.values())])
-    if force or lowest != _root_applied:
-        logging.getLogger().setLevel(lowest)
-        _root_applied = lowest
+        if force or lowest != _root_applied:
+            logging.getLogger().setLevel(lowest)
+            _root_applied = lowest
+
+
+# --- erased accounts ------------------------------------------------------------------------
+# `auth.purge_user` deletes an account's `log_events` rows, but a line about that account can still
+# be on its way: the erasing request's own access line is logged AFTER the handler committed, a queued
+# row waits for the sink's writer, a background task logs later. Those rows are stored without the
+# account (`logsink` asks here). Remembered for an hour in this process — a line later than that has
+# no request left to come from, and the retention job is the backstop for any other process.
+ERASED_MEMORY_SECONDS = 3600.0
+_erased: dict[int, float] = {}
+_erased_lock = threading.Lock()
+# Held by whoever checks rows against `is_erased` AND writes them (`erasure_guard`). `forget_user`
+# takes it too, so an erasure waits for a write that already passed the check to commit — and the
+# purge's DELETE, which runs after `forget_user`, then removes those rows as well. Without it a row
+# checked a moment before the erasure could be inserted a moment after the DELETE.
+_erasure_guard = threading.Lock()
+
+
+def erasure_guard() -> threading.Lock:
+    """Hold this around "drop erased accounts from these rows, insert them, commit"."""
+    return _erasure_guard
+
+
+def forget_user(user_id: int) -> None:
+    """Mark `user_id` erased: no line logged about it from now on is stored under its id. Call BEFORE
+    deleting its rows (see `_erasure_guard`)."""
+    now = time.monotonic()
+    with _erasure_guard, _erased_lock:
+        for stale in [u for u, at in _erased.items() if now - at > ERASED_MEMORY_SECONDS]:
+            del _erased[stale]
+        _erased[user_id] = now
+    with _elevations_lock:
+        _elevations.pop(user_id, None)
+
+
+def is_erased(user_id: int | None) -> bool:
+    if user_id is None:
+        return False
+    with _erased_lock:
+        at = _erased.get(user_id)
+    return at is not None and time.monotonic() - at <= ERASED_MEMORY_SECONDS
 
 
 def current_source() -> str:
@@ -537,10 +590,10 @@ async def log_requests(request, call_next):
         "status": status,
         "duration_ms": duration_ms,
     }
-    # Teljes (TRACE, the user's or the whole process's): the query string too — redacted, and in
-    # attrs only, never in the message.
+    # Teljes (TRACE) the user consented to: the query string too — redacted, and in attrs only, never
+    # in the message.
     if request.url.query and _traced(scope):
-        attrs["query"] = redact_text(request.url.query)
+        attrs["query"] = redact_query(request.url.query)
     _request_log.log(
         level,
         "%s %s %s",
@@ -563,10 +616,10 @@ async def log_requests(request, call_next):
 
 
 def _traced(scope: _RequestScope) -> bool:
-    """Whether this request is logged at TRACE — its user's consent, or the process's base level."""
-    if scope.level is not None and scope.level <= TRACE:
-        return True
-    return _base_level != logging.NOTSET and _base_level <= TRACE
+    """Whether this request's query string is logged: only under its OWN user's Teljes consent. An
+    admin setting the whole process to TRACE gets more detail, not every user's search terms — the
+    privacy policy promises those are kept only for a user who agreed to it."""
+    return scope.level is not None and scope.level <= TRACE
 
 
 # Anonymous request lines kept per client per minute. Signed-in traffic is not capped: it is a known