fix: stored logs keep bad rows, erased accounts and unconsented queries out

Deep-review round 1 of E22.

- A NUL character (`GET /assets/%00` logs the decoded path) made Postgres
  refuse the row and with it the sink's whole batch, every user's rows
  included. `to_row` replaces NUL in every text column and in attrs.
- An erased account's lines kept arriving after purge_user's DELETE: the
  erasing request's own access line, a queued row, a background task.
  `logs.forget_user` runs first; later rows are stored without the account,
  and the check and the insert share a lock with the erasure.
- An admin setting the whole process to TRACE logged every user's query
  string. The query is now logged only under the user's own Teljes consent,
  and decoded before redaction, so `%40` no longer hides an address.
- The browser log ingest has an hourly storage budget per account (5 MiB,
  one notice when spent) and reads only a JSON Content-Type, so a
  same-site text/plain form post cannot write into a user's log.
  RateLimiter takes a per-attempt cost for the byte budget.
- The root level is applied under the elevation lock: two concurrent
  changes could leave it at the base while an elevation was active.
- Tests for the running sink (level gate, drain on stop) and for the
  admin log level applied at runtime and at boot.

backend/app/logsink.py

@@ -78,21 +78,47 @@ def should_store(record: logging.LogRecord) -> bool:
     return getattr(record, "event", None) == "http.request" and record.levelno >= logging.INFO
 
 
+def _without_nul(value: Any) -> Any:
+    """`value` with every NUL character replaced, in keys and nested values alike. Postgres refuses
+    NUL in text and `\\u0000` in JSONB, and a refused row fails the WHOLE batch it rides in — every
+    user's rows with it. Anything logged can carry one (`GET /assets/%00` logs the decoded path)."""
+    if isinstance(value, str):
+        return value.replace("\x00", "�")
+    if isinstance(value, dict):
+        return {_without_nul(k): _without_nul(v) for k, v in value.items()}
+    if isinstance(value, list):
+        return [_without_nul(v) for v in value]
+    return value
+
+
 def to_row(fields: dict[str, Any]) -> dict[str, Any]:
     """`logs.record_fields` output → a `log_events` row: known columns only, text clipped to its
-    column, attrs made JSON-safe (anything exotic becomes its `str`, as on stdout)."""
+    column and free of NUL, attrs made JSON-safe (anything exotic becomes its `str`, as on stdout)."""
     row = {
         column: fields.get(column) for column in LogEvent.__table__.columns.keys() if column != "id"
     }
     for column, limit in _LIMITS.items():
         value = row.get(column)
-        if isinstance(value, str) and len(value) > limit:
-            row[column] = value[: limit - 1] + "…"
+        if isinstance(value, str):
+            value = _without_nul(value)
+            row[column] = value[: limit - 1] + "…" if len(value) > limit else value
     if row["attrs"] is not None:
-        row["attrs"] = json.loads(json.dumps(row["attrs"], ensure_ascii=False, default=str))
+        row["attrs"] = _without_nul(
+            json.loads(json.dumps(row["attrs"], ensure_ascii=False, default=str))
+        )
     return row
 
 
+def without_erased(rows: list[dict[str, Any]]) -> list[dict[str, Any]]:
+    """The rows, with the account taken off any whose account was erased meanwhile
+    (`logs.forget_user`). Checked right before the INSERT, under `logs.erasure_guard()` held until
+    the commit: a row built before the erasure can still be waiting for its batch."""
+    for row in rows:
+        if logs.is_erased(row.get("user_id")):
+            row["user_id"] = None
+    return rows
+
+
 def _notice(code: str, msg: str, **attrs: Any) -> dict[str, Any]:
     """A row the sink writes about ITSELF. Built directly, not logged: logging it would route it back
     through this sink (and the writer thread's own records are deliberately ignored)."""
@@ -220,8 +246,8 @@ class LogSink(logging.Handler):
         if not rows:
             return 0
         try:
-            with self._bind.begin() as conn:
-                conn.execute(insert(LogEvent), rows)
+            with logs.erasure_guard(), self._bind.begin() as conn:
+                conn.execute(insert(LogEvent), without_erased(rows))
         except Exception as exc:  # noqa: BLE001 — the database is down or refused the batch
             print(
                 f"log sink: could not store {len(rows)} log events: {logs.redact_text(str(exc))[:300]}",