MQTT-FIX-T02: bound Docker logs and document production rollout

tests/test_deployment.py

@@ -87,6 +87,23 @@ def test_compose_defaults_business_timezone_and_dev_inherits_it() -> None:
         assert "TZ" not in dev["services"].get(service_name, {}).get("environment", {})
 
 
+def test_compose_log_rotation_is_string_typed_and_dev_inherits_it() -> None:
+    """Both services use bounded json-file logs; dev layering keeps base policy."""
+    base = _read_yaml("docker-compose.yml")
+    dev = _read_yaml("docker-compose.dev.yml")
+    expected = {
+        "driver": "json-file",
+        "options": {"max-size": "10m", "max-file": "3"},
+    }
+
+    for service_name in ("migration", "app"):
+        base_logging = base["services"][service_name]["logging"]
+        assert base_logging == expected
+        assert all(isinstance(value, str) for value in base_logging["options"].values())
+        # The override does not define logging, so Compose retains the base value.
+        assert "logging" not in dev["services"].get(service_name, {})
+
+
 def test_compose_keeps_app_non_root_and_maps_minimal_warmtelink_serial_access() -> None:
     """Base Compose maps the configured device with only pyserial's required access.