Improve logging configuration and failure diagnosability

[bencehezso]

Summary

Runs were noisy by default yet hard to debug after the fact: the import-time basicConfig printed raw INFO/DEBUG lines straight over the Rich step UI, several modules pinned their own loggers to INFO (so DEBUG never surfaced anywhere), and an unexpected failure collapsed to a single Unexpected error: ... line with no traceback and no log file. On top of that, sync_assessment raised where every sibling stage returned {"success": ...}, so an online-sync failure exited UNEXPECTED instead of RISK_ASSESSMENT, and the AWS inventory swallowed per-service errors silently — a throttled or access-denied service looked identical to an empty one. This PR makes the console quiet by default but fully diagnosable: verbosity is opt-in via -v/-vv, every run writes a complete run.log, log levels are re-leveled to mean something, and unexpected crashes now leave an actionable traceback behind.

What changed

• main.py — replaced the import-time basicConfig with configure_logging(), which routes all logs through a Rich handler and gates the console level on a -v count: WARNING by default, INFO at -v, DEBUG + third-party at -vv. -v/--verbose is exposed on both the aws and azure subcommands via a shared parent parser. Added add_run_log_handler(), which always writes a DEBUG run.log to the report directory (guarded so a logging-setup failure can never abort a run). Third-party loggers (botocore, boto3, azure) stay muted until -vv; PIL's per-PNG-chunk tracing is pinned to WARNING always. The unexpected-error handler now writes the full traceback to error-<ts>.log in the report directory (falling back to the cwd if the crash predates the directory), prints its path, and also funnels it to run.log.
• core/engine.py — sync_assessment now returns the {"success": ...} contract its sibling stages use instead of raising in its three failure paths, so online-sync failures exit RISK_ASSESSMENT rather than UNEXPECTED. Expected credential/permission-validation failures dropped from ERROR to WARNING (genuine unexpected errors stay ERROR).
• core/utils_aws.py — the per-service except now logs at DEBUG (which service/operation/region + the error) and continues, so a throttled/denied/region-unavailable service is distinguishable from an empty one in run.log without flooding the console.
• core/utils_db.py, core/utils_azure.py — low-level helpers that re-raise now log at DEBUG instead of ERROR, so the stage boundary emits the single ERROR (with traceback) rather than double-logging.
• utils/sync.py, utils/connection.py — expected "not configured / offline skip" conditions dropped to DEBUG; added exc_info=True to the real request/JSON failures that lacked it.
• utils/azure.py, utils/utils.py — input-validation retry-loop messages dropped from WARNING to DEBUG (the prompt already re-asks visibly).
• core/utils_db.py, core/utils_sync.py, core/utils_report.py, core/utils_report_json.py, core/utils_report_egress.py, core/utils_report_pdf.py, core/utils_report_html.py — removed seven per-module setLevel(logging.INFO) pins that were swallowing DEBUG at the source and defeating run.log; filtering is now the handlers' job.
• tests/test_engine.py, tests/test_utils_and_main.py, tests/test_utils_aws.py — added 6 tests: sync_assessment's return contract (offline / server failure / local-DB failure all return, never raise), the unexpected-error traceback file, the online-sync → RISK_ASSESSMENT exit path, and the AWS per-service skip being logged at DEBUG only (asserts nothing is emitted at ≥ WARNING). Full suite: 215 passing, black-clean.

Notes for reviewers

• Behavior change: the default console log level is now WARNING (was effectively INFO), so raw INFO/DEBUG lines no longer print on a normal run — the Rich step UI plus warnings/errors remain.
• Exit-code change: online-sync failures now exit RISK_ASSESSMENT instead of UNEXPECTED.
• run.log captures DEBUG payload dumps (API result + outgoing sync payload); confirmed these carry no secrets.