fix(sentry): drop operator-input/config noise events (#3034) (#3158)

- ignore django.security.DisallowedHost logger (scanner Host-header
  noise on internet-exposed devices) — ANTHIAS-2A
- downgrade migration 0005 auth_basic config warnings from error to
  warning so they no longer become Sentry events — ANTHIAS-1S/1Z
- add regression test asserting the DisallowedHost logger is ignored

AuthSettingsError logging (ANTHIAS-1P/1R/1X) was already downgraded and
backstopped in before_send by #3068.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/anthias_server/app/migrations/0005_migrate_basic_auth_to_user.py

@@ -184,10 +184,15 @@ def _migrate(apps, schema_editor):  # type: ignore[no-untyped-def]
     #     clearing the flag.
     #   * ``auth_basic`` selected with a legacy SHA256 / plaintext hash
     #     → unverifiable by Django's hashers. Same fail-open.
+    # These two branches are operator-config conditions we handle by
+    # failing open, not bugs: the device recovers on its own and the
+    # log line already tells the operator how to re-set the password.
+    # Log at warning, not error — an ERROR-level record is what Sentry's
+    # logging integration turns into an event (ANTHIAS-1S / ANTHIAS-1Z).
     disable_auth = False
     if auth_backend == 'auth_basic':
         if not creds_present:
-            logging.error(
+            logging.warning(
                 'auth_basic enabled in %s but credentials are missing; '
                 'disabling basic auth to avoid a lockout. Re-set the '
                 'password from the Settings page.',
@@ -195,7 +200,7 @@ def _migrate(apps, schema_editor):  # type: ignore[no-untyped-def]
             )
             disable_auth = True
         elif not creds_django_format:
-            logging.error(
+            logging.warning(
                 'Insecure password hash in %s; clearing credentials and '
                 'disabling basic auth. Re-set the password from the '
                 'Settings page.',

src/anthias_server/django_project/settings.py

@@ -201,6 +201,16 @@ ignore_logger('celery.backends.redis')
 # fetch); a persistent outage still surfaces via the watchdog restart
 # loop. (Sentry ANTHIAS-3X.)
 ignore_logger('celery.backends.asynchronous')
+# A device exposed to the internet gets a steady drip of background
+# scanners and bots hitting it with a bogus/spoofed Host header
+# ("Invalid HTTP_HOST header: '141.212.44.121/..'"). Django rejects the
+# request with a 400 and logs it at ERROR to ``django.security.
+# DisallowedHost``, which the logging integration then turns into a
+# Sentry event. It is neither an Anthias bug nor actionable — the
+# request never reaches a view — so silence the logger, exactly as
+# Django's own docs suggest for this well-known noise source. (Sentry
+# ANTHIAS-2A.)
+ignore_logger('django.security.DisallowedHost')
 
 
 def get_sentry_release() -> str | None:

tests/test_sentry.py

@@ -278,6 +278,17 @@ class TestBeforeSendTransientNoise:
         # fatal level on a sustained redis outage (Sentry ANTHIAS-3X).
         assert 'celery.backends.asynchronous' in _IGNORED_LOGGERS
 
+    def test_disallowed_host_logger_is_ignored(self) -> None:
+        # An internet-exposed device gets scanned with bogus/spoofed
+        # Host headers; Django rejects each with a 400 and logs it at
+        # ERROR to django.security.DisallowedHost, which the logging
+        # integration would otherwise turn into a Sentry event. It is
+        # non-actionable background-scanner noise (Sentry ANTHIAS-2A).
+        import anthias_server.django_project.settings  # noqa: F401
+        from sentry_sdk.integrations.logging import _IGNORED_LOGGERS
+
+        assert 'django.security.DisallowedHost' in _IGNORED_LOGGERS
+
 
 class TestGetBoardModel:
     """Board-model detection feeding the fleet-triage Sentry tags."""