Apply LOG_LEVEL as a threshold across the resolver and both daemons

[andylemin]

LOG_LEVEL: ERROR still emitted per-query informational logs, on the resolver
and on both daemons. Three separate causes, all of which the shipped configs
trigger.

The resolver never applied LOG_LEVEL at all

The only test of its value anywhere in pfui_unbound.py was == "DEBUG". Eight
informational lines were therefore gated on LOGGING alone and printed at every
level, and eight more had no guard at all and printed even with
LOGGING: False:

pythonmod: operate, id: 0, module_event_pass
PFUIDNS: Sending '{...}' to /var/run/pfui/pfui_firewall.sock
PFUIDNS: www.example.com. Found IPv4 address 93.184.216.34

The shipped pfui_unbound.yml sets LOGGING: True with LOG_LEVEL: ERROR,
which is precisely the combination that emits them, so every install did this.

Unbound injects log_info and log_err into the embedded interpreter and both
write unconditionally, so there is no framework doing the filtering and the
module has to do it itself. log_at(level) is that filter and all 22 sites now
name a severity. log_err stays ungated: the level chooses how much detail
accompanies a fault, not whether faults are reported.

server-python escaped this because it uses stdlib logging with setLevel(),
and the Rust daemon because Logger::info suppresses at ERROR.

Two of those lines were failures, not chatter

Gating them at DEBUG would have traded per-query noise for a dead firewall
invisible at the default level, so they are errors now.

Line	Was	Now
no acknowledgement from {target}, last was ...	log_info, ungated	log_err
Timeout udp receive - all retries	log_info, ungated	log_err

The daemons' reply line ignored LOGGING

Close msg: ACKUPDATE was the one per-message line in either daemon not gated on
LOGGING; the Rust daemon inherited it from the Python reference. The installers
ship LOGGING: False with LOG_LEVEL: DEBUG, so both wrote a syslog line per
DNS answer while verbose logging was nominally off. It is duplicative too: a
refusal is already reported at error level with its reason, and a success by the
gated PF Table updated line. A test asserts the refusal path still leaves a
trace with logging off, so the gate cannot hide why a message was rejected.

LOG_LEVEL was case-sensitive everywhere

The Rust daemon matched raw yml text while the CTL match directly below it
trims and folds case, so debug fell through to the catch-all and silently
selected ERROR. The Python daemon compared raw text the same way, self.stats
included. Both normalise now, and the resolver says so out loud when a value is
unrecognised, because the symptom of a typo is silently quieter logs.

Two gaps that would have made the fix look wrong

• log_at("INFO") had no call sites, so INFO would have behaved identically to
  ERROR while the yml advertises it for testing.
• The circuit breaker logged opening at error level and closing silently, so an
  operator watched a firewall leave and never saw it return. Recovery is now the
  INFO tier's content, reported on the transition only, never per successful
  query.

What each level gives you

Level	Output
ERROR (default)	Faults only: refusals with their likely cause, breaker trips, socket errors
INFO	Plus operational transitions, such as a firewall acknowledging again
DEBUG	Plus per-query detail, the RR dump, and the Query Unblocked latency line

Documentation

BLOCKING had no prose, only two example lines that read like something to opt
into. It is the default. The new section separates what it governs — a freshly
resolved answer waits for ACKUPDATE, a cache hit does not wait whatever the
setting is, because a positive cached answer implies access was already allowed
by the rr report that released it and the cache report only resets the TTL. A
test pins that, and the behaviour is unchanged. The latency figure is scoped to
the round trip it measures, since it was being read as a general number.

The blocklist example now prefers HaGeZi's lists, with a tier table. HaGeZi
publishes no /etc/hosts format, so unbound-adblock's -l/-u do not apply
and the domain-only lists go in through -d/-t. Two further paths do not work
and are called out: the adblock/ directory carries ABP filter syntax, which
unbound-adblock does not parse, and the plain wildcard/*.txt files carry *.
wildcards. Only the -onlydomains variants are usable.
tools/update_dns_blocklist.sh still fetches StevenBlack in hosts format, which
the section notes rather than papers over.

Testing

• 246 Python tests, 100 Rust unit tests, framing and message vector suites clean
• Each new test verified failing against the old behaviour first: the threshold
  test fails if log_at returns unconditionally, the error-visibility test if
  no acknowledgement returns to log_info, the daemon test if Close msg
  loses its gate
• One test caught a real inconsistency while being written — load_config
  stripped whitespace from LOG_LEVEL but log_at did not, so " DEBUG " was
  honoured at load and ignored at use

Follow-ups, not in this change

• pfui_wire.py imports lz4.frame unconditionally, so COMPRESS: False does
  not make the package optional the way it is meant to
• COMPRESS is one global key per end, so it cannot be off for a local socket
  and on for a remote resolver
• On the stream transports the client reads its reply until EOF, and the daemon
  closes only after Redis and the persist write, so a blocking query appears to
  wait for work the PF → ACKUPDATE → Redis → persist ordering exists to exclude