feat(observability): structured logging foundation and error taxonomy

[kiro-agent]

This pull request was created by @kiro-agent on behalf of @ccrsxx 👻

Comment with /kiro fix to address specific feedback or /kiro all to address everything.
_{Learn about Kiro Web}

---

Summary

First PR in the observability roadmap (Phase 0/1 prerequisite). Makes the API's logs immediately useful in Loki/Grafana and lays the correlation groundwork for tracing. Additive, no new dependencies, no behavior change for clients.

Logging

• Drop the GCP Cloud Logging severity/message renaming (leftover from Cloud Run). Keeps slog defaults (level/msg/time) so Grafana level detection and Logs Drilldown work.
• Decouple format from env via LOG_FORMAT (json|text) so the JSON pipeline can be tested locally instead of only in prod.
• ContextHandler slog middleware enriches every log line with trace_id/span_id/request_id/route pulled from the request context — existing slog.*Context calls across all feature packages become correlated for free.
• Base attributes service_name + deployment_environment on every line (label convention).

Request correlation

• RequestID middleware (registered outermost): reads a W3C traceparent, an inbound X-Request-Id, or generates a UUID; echoes X-Request-Id back so users can quote it when reporting issues.

Request logging middleware

• duration_ms is now a number (was the string "1.5ms", unqueryable).
• Logs the low-cardinality matched route (r.Pattern) alongside the raw path, plus response bytes.
• Skips /sse so long-lived streams don't corrupt latency aggregations.

Error taxonomy (Loki-based error reporting foundation)

• Severity by status class: 5xx → error, 429 → info (expected/high-volume), other 4xx → warn. So level="error" finally means "my fault".
• Stable error_kind fingerprint for grouping: HTTPError.Code → http_<status> → Go type name for unhandled → first application stack frame for panics.
• Optional Code field added to HTTPError (backwards compatible; all call sites use named literals).

Testing

• go build ./... ✅
• go test ./... ✅ all packages pass
• go vet ✅ / gofmt ✅ clean
• Note: golangci-lint could not run in the sandbox (its binary was built with Go 1.24, below this repo's 1.26 target). Please confirm CI lint locally.
• No new tests added (per request); existing tests unchanged and green.

Follow-ups (separate PRs)

• OpenTelemetry tracing + otelpgx + client transports (adds deps)
• /metrics + /healthz on an internal-only port, Go runtime + custom SSE/cache/upstream metrics
• homelab repo: LGTM stack (docker/observability + docker/observability-agent)