fix(logging): redact production diagnostics and disable API access logs

scripts/release/README.md

@@ -322,3 +322,10 @@ work; installing the profile alone does not route existing service logs or verif
 their privacy. The profile relies on the pinned systemd 262
 [namespace interface](https://github.com/systemd/systemd/blob/v262/man/systemd.exec.xml)
 and [journal configuration](https://github.com/systemd/systemd/blob/v262/man/journald.conf.xml).
+
+Production API logging uses a closed event vocabulary and omits arbitrary library
+messages, arguments, paths and exception text. Uvicorn's separate error handlers
+are redirected through that formatter; installed API launchers disable access
+logging so request query strings are not copied into service logs. Development
+diagnostics remain separate. These ordinary formatting checks are not evidence
+of actual daemon, HTTP or upload log privacy; that is still a VM acceptance case.

scripts/release/build.py

@@ -16,7 +16,7 @@ ENTRYPOINTS = {
     "kf-delivery": "scripts.release",
     "kf-api": (
         "uvicorn kf_oj.api.app:create_app --factory --host 127.0.0.1 --port 8000 "
-        "--no-proxy-headers --limit-concurrency 32 --backlog 64"
+        "--no-proxy-headers --no-access-log --limit-concurrency 32 --backlog 64"
     ),
     "kf-outbox-publisher": "kf_oj.workers.outbox",
     "kf-problem-import-worker": "kf_oj.workers.problem_import",

scripts/release/service_bootstrap.py

@@ -31,6 +31,7 @@ PYTHON_MODULES = {
         "--port",
         "8000",
         "--no-proxy-headers",
+        "--no-access-log",
         "--limit-concurrency",
         "32",
         "--backlog",