[Viccodes11]

Closes #1700

Summary of Changes

Adds structured JSON request logging, request ID propagation, database latency tracking, and Server-Timing headers to the deployed API:

• apilib/log.mjs:
  • Structured pino logger configuring JSON output, log level from LOG_LEVEL, and redaction for authorization, cookies, and secret/signedXdr fields.
  • Request ID middleware: reads x-request-id header (validates format and <= 64 chars) or generates a UUID, attaches child logger to req.log, sets x-request-id header on responses.
  • Access log on request finish with method, route pattern (/vaults/:id instead of raw URL to avoid cardinality and PII leaks), status, total latency, and store kind. Logs 5xx as error, 4xx as warn, 2xx/3xx as info.
  • Database timing: wrapPoolForTiming wraps pool and client queries to track cumulative DB duration per request and logs slow queries taking longer than SLOW_QUERY_MS (default 500ms) with statement fingerprints omitting parameter values.
  • Server-Timing header emitted on responses (db;dur=..., total;dur=...).
• api/index.mjs:
  • Registers requestIdMiddleware().
  • Updates error handling wrapper to log { err: e } using req.log.error() and return { error: 'Internal error', requestId } on 500 errors.
• apilib/store.mjs:
  • Wraps Postgres pool with wrapPoolForTiming.
• .env.example:
  • Documents LOG_LEVEL and SLOW_QUERY_MS.
• Tests:
  • apilib/__tests__/log.test.mjs: Unit tests for request ID validation, access logs, pino capture redaction, fingerprinting, and slow query logging with a stubbed pool.
  • api/__tests__/observability.test.mjs: HTTP-level integration tests for request ID echoing/replacement, Server-Timing header, and 500 error correlation ID.