feat(observability): configurable logging, request ids and error logs

- internal/logging: LOG_LEVEL/LOG_FORMAT parsing and slog handler
- request_id middleware (X-Request-ID or generated, echoed) + debug access log
- httpx registers errors; middleware logs internal causes with request_id
- health excluded, objects/sse debug-only, no query/body/secrets in logs
- new observability capability spec; README/.env.example docs

backend/internal/httpx/httpx.go

@@ -53,6 +53,7 @@ func Internal(message string) *AppError {
 }
 
 func Abort(c *gin.Context, err error) {
+	_ = c.Error(err)
 	var appErr *AppError
 	if errors.As(err, &appErr) {
 		c.AbortWithStatusJSON(appErr.Status, ErrorResponse{ErrorBody{appErr.Code, appErr.Message}})
@@ -62,6 +63,7 @@ func Abort(c *gin.Context, err error) {
 }
 
 func RespondError(c *gin.Context, err error) {
+	_ = c.Error(err)
 	var appErr *AppError
 	if errors.As(err, &appErr) {
 		c.JSON(appErr.Status, ErrorResponse{ErrorBody{appErr.Code, appErr.Message}})