feat(logging): correlate requests with X-Request-Id across logs and responses

[jahrulezfrancis]

Summary

• Add per-request correlation IDs so access logs, Winston service logs, and HTTP responses can be traced end to end.
• Honor validated client-supplied X-Request-Id values; generate UUID v4 otherwise.
• Propagate the ID via AsyncLocalStorage into Winston and Morgan, and expose it on every response.

What changed

• New requestIdMiddleware + request-context (AsyncLocalStorage)
• Winston format includes requestId; Morgan logs :id
• Error envelope includes error.requestId; X-Request-Id on all responses
• Unit + app-level tests; docs in API.md and OPERATIONS.md

Key implementation details

• Format: UUID v4 (crypto.randomUUID())
• Inbound policy: honor if ≤128 chars and [A-Za-z0-9_.:-]; otherwise overwrite (never 4xx)
• Propagation: AsyncLocalStorage so services/loggers do not need an explicit ID argument
• Out of scope: OpenTelemetry spans (separate roadmap item)

Testing / verification

• pnpm lint
• pnpm test:ci (333 passed)
• pnpm build — blocked by pre-existing reward.service.ts TS2554 (Error cause / ES2020 lib); unrelated to this PR

Notes

• Backward compatible: unknown header/field ignored by existing clients
• No OpenAPI/SDK regeneration required

Related Issue

Closes #13

[jahrulezfrancis]

@merlik787-droi I'm still waiting for a review on this