fix: suppress application healthcheck logs

docs/operations.md

@@ -13,6 +13,11 @@ Compose health checks all services. Through the virtual host, the public health
 is `http://azionelab.org:8080/health/`; the aggregate content endpoint is
 `http://azionelab.org:8080/api/site/home/`.
 
+Frontend and backend container logs suppress successful request and informational
+entries by default, while warnings and errors remain visible. NGINX retains its access
+log for request-level diagnostics. The frontend health check requests a static asset so
+it does not render the home page or query the CMS.
+
 Test routing without changing the hosts file:
 
 ```bash

docs/security.md

@@ -17,6 +17,9 @@
   retain, and delete them according to the operator's privacy policy.
 - Avoid placing personal phone numbers or private contact details in logs. The API
   legitimately exposes only contact details approved for publication.
+- Frontend and backend informational/access logs are suppressed by default, reducing
+  routine client metadata in application logs without hiding warnings or errors. NGINX
+  remains the request-level access log and must receive the same retention controls.
 - Dependency and image versions are explicit. Operators remain responsible for patch
   upgrades, vulnerability scans, and production digest pinning.
 - NGINX forwards the original host and standard client/protocol headers. Django trusts