feat(observability): configurable logging, request ids and error logs

- internal/logging: LOG_LEVEL/LOG_FORMAT parsing and slog handler
- request_id middleware (X-Request-ID or generated, echoed) + debug access log
- httpx registers errors; middleware logs internal causes with request_id
- health excluded, objects/sse debug-only, no query/body/secrets in logs
- new observability capability spec; README/.env.example docs

backend/internal/logging/logging_test.go

@@ -0,0 +1,95 @@
+package logging
+
+import (
+	"log/slog"
+	"strings"
+	"testing"
+)
+
+func TestParseLevel(t *testing.T) {
+	cases := []struct {
+		in   string
+		want slog.Level
+		ok   bool
+	}{
+		{"debug", slog.LevelDebug, true},
+		{"DEBUG", slog.LevelDebug, true},
+		{" info ", slog.LevelInfo, true},
+		{"warn", slog.LevelWarn, true},
+		{"warning", slog.LevelWarn, true},
+		{"error", slog.LevelError, true},
+		{"trace", 0, false},
+		{"", 0, false},
+	}
+	for _, c := range cases {
+		got, err := ParseLevel(c.in)
+		if c.ok && err != nil {
+			t.Errorf("ParseLevel(%q) unexpected error: %v", c.in, err)
+		}
+		if !c.ok && err == nil {
+			t.Errorf("ParseLevel(%q) expected error, got %v", c.in, got)
+		}
+		if c.ok && got != c.want {
+			t.Errorf("ParseLevel(%q) = %v, want %v", c.in, got, c.want)
+		}
+	}
+}
+
+func TestParseFormat(t *testing.T) {
+	cases := []struct {
+		in   string
+		want string
+		ok   bool
+	}{
+		{"", "json", true},
+		{"json", "json", true},
+		{"TEXT", "text", true},
+		{" text ", "text", true},
+		{"xml", "", false},
+	}
+	for _, c := range cases {
+		got, err := ParseFormat(c.in)
+		if c.ok && err != nil {
+			t.Errorf("ParseFormat(%q) unexpected error: %v", c.in, err)
+		}
+		if !c.ok && err == nil {
+			t.Errorf("ParseFormat(%q) expected error, got %q", c.in, got)
+		}
+		if c.ok && got != c.want {
+			t.Errorf("ParseFormat(%q) = %q, want %q", c.in, got, c.want)
+		}
+	}
+}
+
+func TestRequestIDHelpers(t *testing.T) {
+	if !ValidRequestID("req-abc_123.4") {
+		t.Error("ValidRequestID(valid) = false")
+	}
+	for _, bad := range []string{"", "has space", "has\nnewline", "semi;colon", strings.Repeat("a", 129)} {
+		if ValidRequestID(bad) {
+			t.Errorf("ValidRequestID(%q) = true, want false", bad)
+		}
+	}
+	id := NewRequestID()
+	if id == "" || !ValidRequestID(id) {
+		t.Fatalf("NewRequestID() = %q, want a valid non-empty id", id)
+	}
+	if NewRequestID() == id {
+		t.Fatal("NewRequestID() returned the same value twice")
+	}
+}
+
+func TestNewHandler(t *testing.T) {
+	for _, format := range []string{"", "json", "JSON", "text"} {
+		h, err := NewHandler(format, slog.LevelInfo)
+		if err != nil {
+			t.Errorf("NewHandler(%q) unexpected error: %v", format, err)
+		}
+		if h == nil {
+			t.Errorf("NewHandler(%q) returned nil handler", format)
+		}
+	}
+	if _, err := NewHandler("xml", slog.LevelInfo); err == nil {
+		t.Error("NewHandler(\"xml\") expected error, got nil")
+	}
+}