fix(lab): silence Asterisk noise at the source, keep notice logging

Follow-up to 3150f78, which over-corrected. Dropping `notice` from logger.conf
made the log quiet by making the gateway undebuggable: Asterisk reports
rejected SIP requests at notice level via log_failed_request ("No matching
endpoint found", "Failed to authenticate"), and on a box whose entire job is
answering SIP those are the most useful lines it produces. A call was refused
and nothing said so.

`notice` is restored. The noise is dealt with where it originates instead:

- modules.conf, new. The image ships `autoload=yes` and loads every module it
  was built with, including chan_alsa on a container with no sound card:
  ~74 ALSA config errors per restart, plus module-load ERRORs for CDR/CEL
  backends, LDAP/ODBC realtime config, and format_ogg_vorbis — none of which
  can work here. Explicit noload for those; autoload stays on, because an
  allow-list would break quietly the first time a scenario needs a module
  nobody remembered to add.

- The healthcheck reduction from 3150f78 (one CLI connection on a 60s
  interval, rather than the image's ~7 every 30s) does the rest.

Verified on galatea: ALSA lines 74 → 0, all startup ERRORs gone (only one-off
benign WARNINGs remain), steady-state 4 lines per 2 minutes against ~840 per
30 minutes originally — and a refused call still logs 6 diagnostic lines.
Transport bound, both endpoints and dialplan loaded, container healthy.

`verbose` stays excluded: dialplan execution is worth having when tracing a
specific call, not worth shipping to Loki continuously. Raise it at runtime
with `asterisk -rx "core set verbose 3"`.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/lab/dialplan/logger.conf

@@ -9,16 +9,22 @@ dateformat = %F %T
 ; mounted for the setting to take effect.
 
 [logfiles]
-; Warnings and errors only. That covers what matters when a lab call
-; misbehaves: failed authentication, no-matching-endpoint, playback failures.
+; `notice` is KEPT, deliberately. Asterisk logs rejected SIP requests at
+; notice level via log_failed_request ("No matching endpoint found",
+; "Failed to authenticate"), and on a box whose whole job is answering SIP
+; those are the single most useful diagnostic. Dropping notice made the log
+; quieter and the gateway undebuggable — a call was refused and nothing said
+; so.
 ;
-; `notice` and `verbose` are both excluded because the "Remote UNIX
-; connection" pairs the healthcheck generates arrive on those channels, and
-; they swamped everything else (the Loki stream measured 100% healthcheck
-; noise before this). The healthcheck itself is also reduced to one CLI call
-; on a 60s interval in docker-compose — the two changes work together.
-;
-; To trace a call's dialplan execution, raise verbosity at runtime rather than
-; leaving it on:
+; `verbose` is excluded: dialplan execution ("Executing [1001@...]") is
+; useful when tracing a specific call, but it is not worth shipping to Loki
+; continuously. Raise it at runtime instead:
 ;     asterisk -rx "core set verbose 3"
-console => warning,error
+;
+; The healthcheck's "Remote UNIX connection" pairs also arrive on notice.
+; They are dealt with at the source rather than by silencing the channel:
+; docker-compose replaces the image's ~7-connections-per-30s healthcheck with
+; a single check on a 60s interval, and modules.conf stops the container
+; loading hardware and database modules it has no use for (~74 ALSA lines per
+; restart). Those two together cut the noise without costing visibility.
+console => notice,warning,error

tests/lab/dialplan/modules.conf

@@ -0,0 +1,46 @@
+; Module loading for the lab.
+;
+; The image ships `autoload=yes`, which loads every module Asterisk was built
+; with. On a headless container that produces a lot of startup noise for
+; hardware and backends that do not exist here — measured at ~74 ALSA lines
+; plus a dozen module-load ERRORs per restart, all of it in Loki. None of it
+; was harmful; all of it made the log harder to read.
+;
+; autoload stays on: this is a lab, and an explicit allow-list would break
+; quietly every time a scenario needs a module nobody remembered to add. The
+; noload lines below are only for modules that *cannot* work in this container.
+[modules]
+autoload=yes
+
+; --- Audio hardware -------------------------------------------------------
+; No sound card in a container. chan_alsa/chan_oss probe for one and emit
+; ~74 lines of ALSA config errors on every start. The media path is RTP via
+; PJSIP, never a local device.
+noload => chan_alsa.so
+noload => chan_oss.so
+noload => chan_console.so
+
+; --- CDR/CEL backends for databases we do not run -------------------------
+; Each logs "declined to load" or a config error at startup. Call records live
+; in Hold Slayer's own Postgres, written by the gateway, not by Asterisk.
+noload => cdr_pgsql.so
+noload => cdr_sqlite3_custom.so
+noload => cdr_custom.so
+noload => cdr_csv.so
+noload => cel_pgsql.so
+noload => cel_sqlite3_custom.so
+noload => cel_custom.so
+
+; --- Realtime config backends we do not use -------------------------------
+; The lab's configuration is the mounted .conf files. LDAP/ODBC/PgSQL realtime
+; each complain about missing connection details on every start.
+noload => res_config_ldap.so
+noload => res_config_odbc.so
+noload => res_config_pgsql.so
+noload => res_config_sqlite3.so
+
+; --- Codecs and formats that fail to initialise ----------------------------
+; format_ogg_vorbis errors on load. The lab plays .sln (signed linear) and
+; negotiates ulaw/alaw, so nothing here needs Vorbis.
+noload => format_ogg_vorbis.so
+noload => format_ogg_speex.so

tests/lab/docker-compose.lab.yml

@@ -24,6 +24,9 @@ services:
       # Carries `nocolor = yes`: without it every log line reaches Loki
       # wrapped in ANSI escape codes.
       - ./dialplan/asterisk.conf:/etc/asterisk/asterisk.conf:ro
+      # noload for hardware/DB modules this container cannot use — the image
+      # autoloads everything, which costs ~74 ALSA lines per restart.
+      - ./dialplan/modules.conf:/etc/asterisk/modules.conf:ro
       # The image ships no sound files at all. These are generated by
       # sounds/generate.py; Asterisk resolves Playback(lab-music) to
       # lab-music.sln here (8kHz signed-linear, no transcoding).