Add request-ID middleware that propagates X-Request-ID via ContextVar

[mvanhorn]

Closes #44.

Why

AuditLogMiddleware already attaches a UUID to request.state.request_id, but anything that runs in the request lifecycle without access to the FastAPI Request object - notably inference/pipeline.py and the helper modules below it - emits log lines that aren't correlated to the inbound HTTP request.

What

Added in src/climatevision/api/middleware.py:

• request_id_var: ContextVar[str | None] so non-FastAPI code can read the active request ID.
• RequestIDMiddleware (BaseHTTPMiddleware) that reads X-Request-ID (UUID4 fallback), stores it on the ContextVar, mirrors it onto request.state.request_id so the existing RequestLoggingMiddleware / AuditLogMiddleware keep working, and echoes the value back on the response. ContextVar is reset() in a finally block so requests don't leak.
• RequestIDLogFilter(logging.Filter) that exposes the ContextVar as record.request_id for log formatters.

setup_logging now installs the filter on the root logger and attaches it to existing handlers, and the JSON log format gains "request_id":"%(request_id)s".

create_app registers RequestIDMiddleware last in add_middleware, which means starlette runs it OUTERMOST -- the ContextVar is set before any other middleware or route handler runs.

Tests

tests/test_request_id_middleware.py covers the three cases in the issue plus a leak check:

• request without X-Request-ID -> response has a UUID-shaped X-Request-ID and the route reads the same value
• request with explicit X-Request-ID: <id> -> response echoes the same value back
• log record emitted from a handler exposes record.request_id matching the inbound id (verified via the filter on a StreamHandler and pytest's caplog)
• after a request finishes, request_id_var.get() is back to None

Locally:

PYTHONPATH=src python3 -m pytest tests/test_request_id_middleware.py -v

reports 4 passed in 0.10s. (The repo's full conftest pulls the inference pipeline which needs GDAL/fiona; the new test file builds a minimal FastAPI app of its own and stays independent.)