feat: dedicated logging for auth and api calls

config/packages/monolog.yaml

@@ -1,6 +1,13 @@
 monolog:
     channels:
         - deprecation # Deprecations are logged in the dedicated "deprecation" channel when it exists
+        # Audit channels, each with its own file in every env (see below).
+        # "auth" is the login/logout/authorization trail, "api" one record per
+        # proxied backend call. Both are excluded from "main" everywhere, so
+        # they never get duplicated — and, in prod, never get swallowed by the
+        # fingers_crossed buffer that only flushes on an error.
+        - auth
+        - api
 
 when@dev:
     monolog:
@@ -9,11 +16,23 @@ when@dev:
                 type: stream
                 path: "%kernel.logs_dir%/%kernel.environment%.log"
                 level: debug
-                channels: ["!event"]
+                channels: ["!event", "!auth", "!api"]
             console:
                 type: console
                 process_psr_3_messages: false
                 channels: ["!event", "!doctrine", "!console"]
+            auth:
+                type: rotating_file
+                channels: [auth]
+                path: "%kernel.logs_dir%/auth.%kernel.environment%.log"
+                max_files: 30
+                level: info
+            api:
+                type: rotating_file
+                channels: [api]
+                path: "%kernel.logs_dir%/api.%kernel.environment%.log"
+                max_files: 14
+                level: info
 
 when@test:
     monolog:
@@ -23,11 +42,23 @@ when@test:
                 action_level: error
                 handler: nested
                 excluded_http_codes: [404, 405]
-                channels: ["!event"]
+                channels: ["!event", "!auth", "!api"]
             nested:
                 type: stream
                 path: "%kernel.logs_dir%/%kernel.environment%.log"
                 level: debug
+            auth:
+                type: rotating_file
+                channels: [auth]
+                path: "%kernel.logs_dir%/auth.%kernel.environment%.log"
+                max_files: 30
+                level: info
+            api:
+                type: rotating_file
+                channels: [api]
+                path: "%kernel.logs_dir%/api.%kernel.environment%.log"
+                max_files: 14
+                level: info
 
 when@prod:
     monolog:
@@ -37,7 +68,7 @@ when@prod:
                 action_level: error
                 handler: nested
                 excluded_http_codes: [404, 405]
-                channels: ["!deprecation"]
+                channels: ["!deprecation", "!auth", "!api"]
                 buffer_size: 50 # How many messages should be saved? Prevent memory leaks
             nested:
                 # Plain rsync/Deployer shared hosting (see deploy.php), not a
@@ -56,3 +87,18 @@ when@prod:
                 channels: [deprecation]
                 path: "%kernel.logs_dir%/%kernel.environment%.deprecation.log"
                 max_files: 14
+            auth:
+                # The audit trail: kept longer than everything else, and never
+                # routed through fingers_crossed — these info records must land
+                # even on a request where nothing went wrong.
+                type: rotating_file
+                channels: [auth]
+                path: "%kernel.logs_dir%/auth.%kernel.environment%.log"
+                max_files: 30
+                level: info
+            api:
+                type: rotating_file
+                channels: [api]
+                path: "%kernel.logs_dir%/api.%kernel.environment%.log"
+                max_files: 14
+                level: info