chore(logs): add explicit http logs

Default is now RUST_LOG=info,http=warn. Effect of each level on the access log:

  ┌────────────────────┬────────────────────────┐
  │   Level on http    │ Status classes emitted │
  ├────────────────────┼────────────────────────┤
  │ info               │ 2xx/3xx + 4xx + 5xx    │
  ├────────────────────┼────────────────────────┤
  │ warn (default)     │ 4xx + 5xx              │
  ├────────────────────┼────────────────────────┤
  │ error              │ 5xx only               │
  ├────────────────────┼────────────────────────┤
  │ off                │ nothing                │
  └────────────────────┴────────────────────────┘

  Target mapping:

  ┌────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┬─────────────────┐
  │                                                       Routes                                                       │     Target      │
  ├────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┼─────────────────┤
  │ health_routes                                                                                                      │ http::probe     │
  ├────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┼─────────────────┤
  │ magic_link_router                                                                                                  │ http::web       │
  ├────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┼─────────────────┤
  │ All /api/auth/* sub-routers (login, register, refresh, public, protected, app_pw, device_public, device_protected) │ http::api::auth │
  ├────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┼─────────────────┤
  │ setup_router, public_api_routes, protected_api, wopi_api_protected                                                 │ http::api       │
  ├────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┼─────────────────┤
  │ well_known_router, caldav_protected, carddav_protected, webdav_protected                                           │ http::dav       │
  ├────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┼─────────────────┤
  │ nc_router                                                                                                          │ http::nextcloud │
  ├────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┼─────────────────┤
  │ wopi_protocol                                                                                                      │ http::wopi      │
  ├────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┼─────────────────┤
  │ web_routes (+ ServeDir fallback)                                                                                   │ http::web       │
  └────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┴─────────────────┘

  # Default value:

  - **http=warn** if target http not specified
  - **http::web=error** if target http::web not specified

  Common operator overrides:

  # Server-error-only access logs (the new default)
  unset RUST_LOG

  # See login failures and other client errors on auth
  RUST_LOG=info,http=warn,http::api::auth=info

  # which is similar to
  RUST_LOG=info,http::api::auth=info

  # Full access log everywhere (heavy)
  RUST_LOG=info,http=info

  # Silence everything except errors
  RUST_LOG=warn

src/interfaces/api/handlers/wopi_handler.rs

@@ -15,7 +15,7 @@ use axum::{
     extract::{Path, Query, State},
     http::{HeaderMap, Request, StatusCode},
     response::{Html, IntoResponse, Response},
-    routing::{get, post},
+    routing::{any, get, post},
 };
 use serde::{Deserialize, Serialize};
 use std::sync::Arc;
@@ -568,6 +568,12 @@ pub fn wopi_routes(
         .route("/edit/{file_id}", get(host_page))
         // Supported extensions (public, no auth)
         .route("/supported-extensions", get(get_supported_extensions))
+        // Collector for any unknown `/wopi/*` path — keeps the
+        // access-log target as `http::wopi` instead of letting
+        // M365/Collabora probes leak into `http::web` via the
+        // ServeDir fallback. Same rationale as the NC `/ocs/*`
+        // catch-all in interfaces/nextcloud/routes.rs.
+        .route("/{*rest}", any(wopi_not_found))
         .with_state(wopi_state.clone());
 
     let api_router = Router::new()
@@ -576,3 +582,14 @@ pub fn wopi_routes(
 
     (protocol_router, api_router)
 }
+
+/// Catch-all 404 for unknown paths nested under `/wopi`. Exists
+/// purely to anchor the access-log target to `http::wopi` instead
+/// of letting the request fall through Axum's matcher to
+/// ServeDir and being mis-attributed to `http::web`.
+async fn wopi_not_found() -> Response {
+    Response::builder()
+        .status(StatusCode::NOT_FOUND)
+        .body(Body::empty())
+        .unwrap()
+}

src/interfaces/api/routes.rs

@@ -2,10 +2,11 @@ use crate::application::services::batch_operations::BatchOperationService;
 use crate::common::di::AppState;
 use axum::{
     Router,
+    body::Body,
     extract::{DefaultBodyLimit, State},
     http::StatusCode,
-    response::{IntoResponse, Json as AxumJson},
-    routing::{delete, get, post, put},
+    response::{IntoResponse, Json as AxumJson, Response},
+    routing::{any, delete, get, post, put},
 };
 use serde_json::json;
 use std::sync::Arc;
@@ -588,6 +589,19 @@ pub fn create_api_routes(app_state: &Arc<AppState>) -> Router<Arc<AppState>> {
         .with_state(app_state.clone());
     router = router.nest("/users", users_router);
 
+    // Collector for any unknown `/api/*` path. Without this, an
+    // unmatched API URL falls through Axum's matcher to the
+    // ServeDir fallback and is logged under `http::web` — wrong
+    // surface for operator triage. Adding the catch-all here
+    // anchors the 404 on whichever access-log layer the parent
+    // mount applies (i.e. `http::api`).
+    //
+    // The bare `/api/auth/*`, `/api/wopi/*`, and other more-
+    // specific nests are registered at higher specificity and
+    // still win over this catch-all — Axum's matcher prefers
+    // them on every overlapping request.
+    router = router.route("/{*rest}", any(api_not_found));
+
     // Compression is applied once, globally, in `main.rs` with a content-type
     // aware predicate that skips already-compressed media. Re-applying it here
     // would double-wrap `/api`: this inner layer (no predicate) would compress
@@ -595,3 +609,12 @@ pub fn create_api_routes(app_state: &Arc<AppState>) -> Router<Arc<AppState>> {
     // So this router only adds tracing; compression is the global layer's job.
     router.layer(TraceLayer::new_for_http())
 }
+
+/// Catch-all 404 for unknown `/api/*` paths. Pure log-anchoring
+/// shim — see the comment in `create_api_routes`.
+async fn api_not_found() -> Response {
+    Response::builder()
+        .status(StatusCode::NOT_FOUND)
+        .body(Body::empty())
+        .unwrap()
+}