feat(observability): configurable logging, request ids and error logs

- internal/logging: LOG_LEVEL/LOG_FORMAT parsing and slog handler
- request_id middleware (X-Request-ID or generated, echoed) + debug access log
- httpx registers errors; middleware logs internal causes with request_id
- health excluded, objects/sse debug-only, no query/body/secrets in logs
- new observability capability spec; README/.env.example docs

.env.example

@@ -46,3 +46,8 @@ SSE_CLIENT_BUFFER=64
 WORKER_INTERVAL=5s
 WORKER_BATCH=10
 WORKER_PENDING_TTL=10m
+
+# Logging. LOG_LEVEL=debug adds per-request access logs and expected 4xx errors.
+# LOG_FORMAT selects the output encoding.
+LOG_LEVEL=info
+LOG_FORMAT=json