[SandObserver]

Summary

• Correct the claim in docs/support.md that both Nginx and the API log to stdout. Nginx sends request errors to stderr and keeps no access log.
• Add a "What a log line looks like" section: the record shape, the five level abbreviations, that AUD is never filtered by the level setting, that the banner is unstructured and always prints, and that secrets are never logged.
• Note that the format is logfmt, so | logfmt parses it in Loki or Grafana with no custom rules.
• Link the LOG_LEVEL row in docs/architecture.md rather than restating the boot-versus-settings precedence it already covers.
• State in both docs/architecture.md and docker-compose.yml that warn and error behave the same; they share a threshold, and listing four names implied four behaviours.
• Add the Unreleased entries for this work, under Added, Changed, Fixed and Security.

Merged last of the five, so it describes what actually shipped. The level names the environment-table row check depends on are unchanged.

Testing
All green, including the Docker build. Documentation only; no new tests, and the existing environment-doc row checks still pass.

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed.
• CHANGELOG.md updated under Unreleased if the change is user-visible.