feat(06-02): add Loki + Promtail + Grafana stack to docker-compose

- Create docker/loki/loki-config.yaml: single-binary filesystem-mode Loki
  (schema v13, tsdb store, embedded_cache 100MB, auth_enabled: false)
- Create docker/loki/promtail-config.yaml: docker_sd_configs scrape with
  label filter logging=promtail; relabels container name and service labels
- docker-compose.yml: add loki (:3100), promtail, grafana (:3000) services
  after celery-beat; loki_data and grafana_data named volumes; GF_AUTH
  anonymous enabled for local dev; backend + celery-worker get logging:
  "promtail" label; backend gets LOG_LEVEL/LOG_JSON env vars
- celery-beat deliberately left without logging: label (not a network-facing
  service; schedule file write concerns deferred per D-08 Pitfall 7 notes)

docker-compose.yml

@@ -67,6 +67,10 @@ services:
       - CORS_ORIGINS=${CORS_ORIGINS:-http://localhost:5173}
       - FRONTEND_URL=${FRONTEND_URL:-http://localhost:5173}
       - PYTHONDONTWRITEBYTECODE=1
+      - LOG_LEVEL=${LOG_LEVEL:-INFO}
+      - LOG_JSON=${LOG_JSON:-false}
+    labels:
+      logging: "promtail"
     extra_hosts:
       - "host.docker.internal:host-gateway"
     command: uvicorn main:app --host 0.0.0.0 --port 8000 --reload
@@ -89,6 +93,8 @@ services:
       - REDIS_URL=${REDIS_URL}
       - CLOUD_CREDS_KEY=${CLOUD_CREDS_KEY}
       - PYTHONDONTWRITEBYTECODE=1
+    labels:
+      logging: "promtail"
     volumes:
       - ./backend:/app
     extra_hosts:
@@ -123,6 +129,37 @@ services:
       redis:
         condition: service_healthy
 
+  loki:
+    image: grafana/loki:latest
+    ports:
+      - "3100:3100"
+    volumes:
+      - ./docker/loki/loki-config.yaml:/etc/loki/local-config.yaml
+      - loki_data:/loki
+    command: -config.file=/etc/loki/local-config.yaml
+
+  promtail:
+    image: grafana/promtail:latest
+    volumes:
+      - ./docker/loki/promtail-config.yaml:/etc/promtail/config.yaml
+      - /var/lib/docker/containers:/var/lib/docker/containers:ro
+      - /var/run/docker.sock:/var/run/docker.sock
+    command: -config.file=/etc/promtail/config.yaml
+    depends_on:
+      - loki
+
+  grafana:
+    image: grafana/grafana:latest
+    ports:
+      - "3000:3000"
+    environment:
+      - GF_AUTH_ANONYMOUS_ENABLED=true
+      - GF_AUTH_ANONYMOUS_ORG_ROLE=Admin
+    volumes:
+      - grafana_data:/var/lib/grafana
+    depends_on:
+      - loki
+
   frontend:
     build: ./frontend
     ports:
@@ -137,3 +174,5 @@ services:
 volumes:
   postgres_data:
   minio_data:
+  loki_data:
+  grafana_data:

docker/loki/loki-config.yaml

@@ -0,0 +1,34 @@
+auth_enabled: false
+
+server:
+  http_listen_port: 3100
+  grpc_listen_port: 9096
+
+common:
+  instance_addr: 127.0.0.1
+  path_prefix: /loki
+  storage:
+    filesystem:
+      chunks_directory: /loki/chunks
+      rules_directory: /loki/rules
+  replication_factor: 1
+  ring:
+    kvstore:
+      store: inmemory
+
+schema_config:
+  configs:
+    - from: 2020-10-24
+      store: tsdb
+      object_store: filesystem
+      schema: v13
+      index:
+        prefix: index_
+        period: 24h
+
+query_range:
+  results_cache:
+    cache:
+      embedded_cache:
+        enabled: true
+        max_size_mb: 100

docker/loki/promtail-config.yaml

@@ -0,0 +1,24 @@
+server:
+  http_listen_port: 9080
+  grpc_listen_port: 0
+
+positions:
+  filename: /tmp/positions.yaml
+
+clients:
+  - url: http://loki:3100/loki/api/v1/push
+
+scrape_configs:
+  - job_name: docker
+    docker_sd_configs:
+      - host: unix:///var/run/docker.sock
+        refresh_interval: 5s
+        filters:
+          - name: label
+            values: ["logging=promtail"]
+    relabel_configs:
+      - source_labels: ["__meta_docker_container_name"]
+        regex: "/(.*)"
+        target_label: "container"
+      - source_labels: ["__meta_docker_container_label_com_docker_compose_service"]
+        target_label: "service"