feat: comprehensive debug logging across all controller modules

Add detailed [DEBUG] logging to every controller module when
logging.level is set to "debug". Each module with stateful debug
uses SetDebug(bool) wired from main.go. Covers stacks, backup,
cloudflare, integrations, system, monitor, settings, scheduler,
web handlers, storage, metrics, API, selfupdate, and assets.

Also includes the app export/import (.fab bundles) feature from
v0.32.0 and its debug page integration.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

controller/internal/stacks/deploy.go

@@ -375,6 +375,10 @@ func (m *Manager) runComposeDeploy(name, stackDir string, env map[string]string,
 
 // UpdateStackConfig updates non-locked fields for a deployed stack.
 func (m *Manager) UpdateStackConfig(name string, values map[string]string) error {
+	if m.isDebug() {
+		m.logger.Printf("[DEBUG] [stacks] UpdateStackConfig called: name=%q, %d values to update", name, len(values))
+	}
+
 	stack, ok := m.GetStack(name)
 	if !ok {
 		return fmt.Errorf("stack %q not found", name)
@@ -396,13 +400,21 @@ func (m *Manager) UpdateStackConfig(name string, values map[string]string) error
 	}
 
 	meta := LoadMetadata(stackDir)
+	var changedKeys []string
 	for key, val := range values {
 		if lockedSet[key] {
 			return fmt.Errorf("field %q is locked and cannot be changed after deployment", key)
 		}
+		if appCfg.Env[key] != val {
+			changedKeys = append(changedKeys, key)
+		}
 		appCfg.Env[key] = val
 	}
 
+	if m.isDebug() {
+		m.logger.Printf("[DEBUG] [stacks] UpdateStackConfig %s: changed keys: [%s], locked keys: %d", name, strings.Join(changedKeys, ", "), len(lockedSet))
+	}
+
 	if err := SaveAppConfig(stackDir, appCfg, m.encKey, SensitiveEnvVars(&meta)); err != nil {
 		return fmt.Errorf("saving updated config: %w", err)
 	}
@@ -445,6 +457,10 @@ func (m *Manager) GetDeployFields(name string) (*Metadata, *AppConfig, error) {
 // UpdateOptionalConfig updates optional env vars in app.yaml and restarts the stack if deployed.
 // Only updates env vars that are listed in the metadata's optional_config sections.
 func (m *Manager) UpdateOptionalConfig(stackName string, values map[string]string) error {
+	if m.isDebug() {
+		m.logger.Printf("[DEBUG] [stacks] UpdateOptionalConfig called: stack=%q, %d values provided", stackName, len(values))
+	}
+
 	stack, ok := m.GetStack(stackName)
 	if !ok {
 		return fmt.Errorf("stack %q not found", stackName)
@@ -461,6 +477,14 @@ func (m *Manager) UpdateOptionalConfig(stackName string, values map[string]strin
 		return fmt.Errorf("no optional config fields defined for %s", stackName)
 	}
 
+	if m.isDebug() {
+		allowedKeys := make([]string, 0, len(allowed))
+		for k := range allowed {
+			allowedKeys = append(allowedKeys, k)
+		}
+		m.logger.Printf("[DEBUG] [stacks] UpdateOptionalConfig %s: allowed fields: [%s]", stackName, strings.Join(allowedKeys, ", "))
+	}
+
 	// Load existing app.yaml (or create empty one)
 	stackDir := filepath.Dir(stack.ComposePath)
 	appCfg := LoadAppConfig(stackDir)
@@ -564,12 +588,14 @@ func LoadAppConfig(stackDir string) *AppConfig {
 	}
 	cfg := &AppConfig{}
 	if err := yaml.Unmarshal(data, cfg); err != nil {
+		log.Printf("[DEBUG] [stacks] LoadAppConfig: failed to parse %s: %v", path, err)
 		return nil
 	}
 	return cfg
 }
 
 func SaveAppConfig(stackDir string, cfg *AppConfig, encKey []byte, sensitiveVars []string) error {
+	encryptedCount := 0
 	// Clone env and encrypt sensitive values
 	saveCfg := &AppConfig{
 		Deployed:     cfg.Deployed,
@@ -585,6 +611,7 @@ func SaveAppConfig(stackDir string, cfg *AppConfig, encKey []byte, sensitiveVars
 		if encKey != nil && sensitiveSet[k] && !crypto.IsEncrypted(v) && v != "" {
 			if enc, err := crypto.Encrypt(encKey, v); err == nil {
 				saveCfg.Env[k] = enc
+				encryptedCount++
 				continue
 			} else {
 				// H10 fix: log encryption failure — value will be saved in plaintext.
@@ -594,6 +621,9 @@ func SaveAppConfig(stackDir string, cfg *AppConfig, encKey []byte, sensitiveVars
 		saveCfg.Env[k] = v
 	}
 
+	log.Printf("[DEBUG] [stacks] SaveAppConfig: saving %s — %d env vars, %d encrypted, %d sensitive fields",
+		stackDir, len(saveCfg.Env), encryptedCount, len(sensitiveVars))
+
 	data, err := yaml.Marshal(saveCfg)
 	if err != nil {
 		return fmt.Errorf("marshaling app config: %w", err)
@@ -617,7 +647,11 @@ func SaveAppConfig(stackDir string, cfg *AppConfig, encKey []byte, sensitiveVars
 // LoadAppConfigDecrypted loads app.yaml and decrypts any encrypted values.
 func LoadAppConfigDecrypted(stackDir string, encKey []byte) *AppConfig {
 	cfg := LoadAppConfig(stackDir)
-	if cfg == nil || encKey == nil {
+	if cfg == nil {
+		return cfg
+	}
+	if encKey == nil {
+		log.Printf("[DEBUG] [stacks] LoadAppConfigDecrypted: no encryption key, returning raw config for %s", stackDir)
 		return cfg
 	}
 	cfg.Env = crypto.DecryptMap(encKey, cfg.Env)
@@ -686,6 +720,10 @@ func generateValue(spec string) (string, error) {
 // yet in app.yaml and auto-generates values for secret/domain fields.
 // Called after sync (for updated stacks) and on startup (for all deployed stacks).
 func (m *Manager) InjectMissingFields(stackNames []string) {
+	if m.isDebug() {
+		m.logger.Printf("[DEBUG] [stacks] InjectMissingFields: checking %d stacks", len(stackNames))
+	}
+
 	for _, name := range stackNames {
 		stack, ok := m.GetStack(name)
 		if !ok {
@@ -696,9 +734,17 @@ func (m *Manager) InjectMissingFields(stackNames []string) {
 		meta := LoadMetadata(stackDir)
 		appCfg := LoadAppConfig(stackDir)
 		if appCfg == nil || !appCfg.Deployed {
+			if m.isDebug() {
+				m.logger.Printf("[DEBUG] [stacks] InjectMissingFields: skipping %s (not deployed or no app config)", name)
+			}
 			continue
 		}
 
+		if m.isDebug() {
+			m.logger.Printf("[DEBUG] [stacks] InjectMissingFields: checking stack %s — %d deploy fields, %d existing env vars",
+				name, len(meta.DeployFields), len(appCfg.Env))
+		}
+
 		var injected []string
 		for _, field := range meta.DeployFields {
 			if _, exists := appCfg.Env[field.EnvVar]; exists {