fix(logrotate): rotate the php-fpm slowlog and let stanzas be added

[zebby76]

Closes the last defect of the analysis pass, and repairs one thing #77 left behind.

The slowlog was never rotated

PHP_FPM_SLOWLOG defaulted to /app/var/log/php-fpm.log.slow, which the rotation glob
/app/var/log/*.log does not match. Asked what it would act on, logrotate answered:

rotating pattern: /app/var/log/*.log 52428800 bytes ...
  considering log /app/var/log/app.log
  considering log /app/var/log/supervisord.log

Never the slowlog. A deployment that turned it on grew one unbounded file on the very volume every
other log was being rotated on — and on an emptyDir, that ends in an evicted pod. After the rename
to php-fpm-slow.log:

  considering log /app/var/log/app.log
  considering log /app/var/log/php-fpm-slow.log

Worth noting why this went unnoticed: the slowlog is off by default
(request_slowlog_timeout is 0), so the file only appears once an operator turns it on — and that
is precisely the operator who then loses the volume. The knob remains, for anyone whose collector
targets the old path by name.

Adding a stanza was documented but impossible

The README described per-file policies, and nothing rendered one. logrotate.conf is an
include /opt/etc/logrotate.d, so it was possible in principle, but base.d/70-logrotate.sh only
ever wrote default.conf.

Every .tmpl in /opt/config/logrotate/logrotate.d is rendered now — the same extension point
/opt/config/sbin already offers — and the options datasource is passed to each, so a stanza can
reuse LOGROTATE_DEFAULT_OPTIONS instead of restating the policy. Verified with a mounted template:

stanzas rendered : default.conf myapp.conf
  rotating pattern: /app/var/log/myapp/*.log 10485760 bytes (3 rotations)
    considering log /app/var/log/myapp/x.log

Sizing, which an operator could not read anywhere

Two consequences of copytruncate are now documented: it loses the lines written between the copy
and the truncation, and a rotation transiently holds the live file, its copy and the compressed
output at once. With the defaults that is roughly 350 MB for /app/var/log/*.log — the number
that decides an emptyDir size.

A defect the demo stacks caught and the image suites could not

Three assertions in demo-prime still checked that /real-time-status, /status and
/server-status answered 200 through Varnish. Varnish fronts the application port, so they were
asserting the very exposure #77 closed.

The same three were inverted on 8.4 while resolving that backport's conflict, and missed here —
they query :6081, and the edit that moved the others matched :9000 only. The PR body of #78 said
these assertions were specific to 8.4; that was wrong, main has them too. They assert 404 now,
on both branches.

This is the argument for running the demo stacks before a release: nginx and apache were 48/48
and could not see it, because Varnish exists only there.

Verification

Image suites on locally built images: nginx 48/48, apache 48/48, cli 8/8. Two new assertions,
both failing against the published 8.5.9 image.

Demo stacks, with demo-infra up: demo-origin 19/19, demo-prime 12/12,
demo-symfony 6/6.

BASH_EXEC, BASH, SHELL_SHFMT, MARKDOWN and NATURAL_LANGUAGE linters clean.

⚠️ Behaviour change

The php-fpm slowlog is written to php-fpm-slow.log instead of php-fpm.log.slow. A collector
targeting the old name has to follow, or set PHP_FPM_SLOWLOG back.

Backport to 8.4 to follow.