Quiet only the stdout UI under --json, not the log level (closes #112)

--json was folded into Quiet, which pinned the stderr log level to WARN.
So `prune --json` gave a machine consumer no record of the local index
rows it deleted, even under --verbose: the audit records were gated off
stdout and pinned below the level on stderr.

--json now quiets only the stdout UI, keeping the JSON document clean
(issue #108); the stderr log level follows --verbose/--debug again, since
diagnostics have gone to stderr since #82. The same coupling is removed
for `snapshot verify`, `snapshot remove`, and `remote info`, which
carried it for the same outdated reason.

A test asserts `--verbose prune --json` emits the cleanup record on
stderr while stdout stays exactly one document, and that --json alone
keeps it below the level.

model: claude-opus-4-8

internal/log/module.go

@@ -14,8 +14,18 @@ var Module = fx.Module("log",
 )
 
 // New creates a new logger configuration from provided options.
+//
+// JSON is intentionally not carried into Config: a command emitting a
+// JSON document on stdout must keep its stderr log level under
+// --verbose/--debug, so --json must not lower it (issue #112). JSON
+// silences the stdout UI in setupGlobals instead.
 func New(opts Options) Config {
-	return Config(opts)
+	return Config{
+		Verbose: opts.Verbose,
+		Debug:   opts.Debug,
+		Cron:    opts.Cron,
+		Quiet:   opts.Quiet,
+	}
 }
 
 // Options are provided by the CLI.
@@ -24,4 +34,8 @@ type Options struct {
 	Debug   bool
 	Cron    bool
 	Quiet   bool
+	// JSON marks a command whose stdout carries a machine-readable
+	// document. It silences the human UI on stdout (see setupGlobals),
+	// but unlike Quiet it leaves the stderr log level alone.
+	JSON bool
 }