feat(06-02): add Loki + Promtail + Grafana stack to docker-compose

- Create docker/loki/loki-config.yaml: single-binary filesystem-mode Loki
  (schema v13, tsdb store, embedded_cache 100MB, auth_enabled: false)
- Create docker/loki/promtail-config.yaml: docker_sd_configs scrape with
  label filter logging=promtail; relabels container name and service labels
- docker-compose.yml: add loki (:3100), promtail, grafana (:3000) services
  after celery-beat; loki_data and grafana_data named volumes; GF_AUTH
  anonymous enabled for local dev; backend + celery-worker get logging:
  "promtail" label; backend gets LOG_LEVEL/LOG_JSON env vars
- celery-beat deliberately left without logging: label (not a network-facing
  service; schedule file write concerns deferred per D-08 Pitfall 7 notes)

docker-compose.yml

@@ -67,6 +67,10 @@ services:
       - CORS_ORIGINS=${CORS_ORIGINS:-http://localhost:5173}
       - FRONTEND_URL=${FRONTEND_URL:-http://localhost:5173}
       - PYTHONDONTWRITEBYTECODE=1
+      - LOG_LEVEL=${LOG_LEVEL:-INFO}
+      - LOG_JSON=${LOG_JSON:-false}
+    labels:
+      logging: "promtail"
     extra_hosts:
       - "host.docker.internal:host-gateway"
     command: uvicorn main:app --host 0.0.0.0 --port 8000 --reload
@@ -89,6 +93,8 @@ services:
       - REDIS_URL=${REDIS_URL}
       - CLOUD_CREDS_KEY=${CLOUD_CREDS_KEY}
       - PYTHONDONTWRITEBYTECODE=1
+    labels:
+      logging: "promtail"
     volumes:
       - ./backend:/app
     extra_hosts:
@@ -123,6 +129,37 @@ services:
       redis:
         condition: service_healthy
 
+  loki:
+    image: grafana/loki:latest
+    ports:
+      - "3100:3100"
+    volumes:
+      - ./docker/loki/loki-config.yaml:/etc/loki/local-config.yaml
+      - loki_data:/loki
+    command: -config.file=/etc/loki/local-config.yaml
+
+  promtail:
+    image: grafana/promtail:latest
+    volumes:
+      - ./docker/loki/promtail-config.yaml:/etc/promtail/config.yaml
+      - /var/lib/docker/containers:/var/lib/docker/containers:ro
+      - /var/run/docker.sock:/var/run/docker.sock
+    command: -config.file=/etc/promtail/config.yaml
+    depends_on:
+      - loki
+
+  grafana:
+    image: grafana/grafana:latest
+    ports:
+      - "3000:3000"
+    environment:
+      - GF_AUTH_ANONYMOUS_ENABLED=true
+      - GF_AUTH_ANONYMOUS_ORG_ROLE=Admin
+    volumes:
+      - grafana_data:/var/lib/grafana
+    depends_on:
+      - loki
+
   frontend:
     build: ./frontend
     ports:
@@ -137,3 +174,5 @@ services:
 volumes:
   postgres_data:
   minio_data:
+  loki_data:
+  grafana_data: