[SandObserver]

Summary

• Add a server-level error_log stderr warn; to nginx/dashboard.conf, so request-time failures appear in docker logs.
• Add a server-level access_log off;, replacing an unrotated file in the container's writable layer.
• Leave the existing access_log off; on the /health location untouched.

Alpine's packaged nginx.conf sends both logs to files under /var/log/nginx. The container installs no logrotate and runs no cron, so nothing read those files and nothing trimmed them.

Both directives are valid in the server context, so this needs no change to /etc/nginx/nginx.conf. The scope limit is deliberate: master and startup errors still follow the main context, and docker-entrypoint.sh already refuses to start on a config nginx rejects.

Testing
All green, including the Docker build. Verified in a built container: a request over the body limit now writes client intended to send too large body to docker logs, an unreachable upstream writes connect() failed, and both files under /var/log/nginx stay at zero bytes. Added 3 tests pinning the two directives and the health-check exclusion.

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed. The documentation change lands separately, so it can describe what actually shipped.
• CHANGELOG.md updated under Unreleased if the change is user-visible. The changelog entry lands with the documentation change.