Give a failed submission a code, and put the cause in the log

A download that died on an HTTP 403 told the submitter "HTTP Error 403:
Forbidden" and told the log "error: exit status 1". The tool's stderr went
into status_msg and nowhere else, so the one person who could act on it saw
nothing. Exactly backwards.

Failures now go through a.fail: the submitter gets a sentence and an eight
character code, the log gets that code, the stage, the submission, the
source URL and the stderr tail. Quote the code, grep the log, find the line.

Every record carries file:line now, and LOG_LEVEL sets the threshold —
failures are logged at error, so no level hides them.

README.md

@@ -76,6 +76,7 @@ in as that account and mint invites for everyone else. The two variables are rea
 | `ADDR` | `:8080` | The only listener |
 | `STORAGE_DIR` | `./storage` | Audio, avatars, in-flight conversions |
 | `SECURE_COOKIES` | `true` | Set `false` for local development over plain HTTP |
+| `LOG_LEVEL` | `info` | `debug`, `info`, `warn` or `error`. An unparseable value falls back to `info` |
 | `PUBLIC_URL` | — | Public address of the site, e.g. `https://levyraati.example.com`. Used to build invite links on the admin page; unset gives relative links |
 
 ### Local development