feat(logging): replace Winston with Pino structured JSON logging and correlation IDs

[CodedSceptre]

Summary

Replace Winston with Pino for structured JSON logging with per-request correlation ID tracing.

What was implemented

• Pino logger (backend/src/logger.ts) — replaces Winston with a Pino instance configured from the LOG_LEVEL env var (supports fatal, error, warn, info, debug, trace)
• Sensitive field redaction — Pino's built-in redact option strips authorization, password, token, privateKey, apiKey, secret, mnemonic, and nested variants (body.password, req.headers.authorization, etc.) before writing any log line
• Correlation ID middleware (correlationIdMiddleware()) — reads X-Request-ID (priority) or X-Correlation-ID from incoming headers, falls back to a fresh UUID v4; stamps req.correlationId and a child req.log logger; echoes the ID back in the X-Correlation-ID response header
• Request logger middleware (createRequestLogger()) — logs one structured JSON line per request/response containing correlationId, method, path, status, durationMs, ip; skips /api/health to reduce noise; uses error/warn/info level based on HTTP status
• Loki/Promtail compatibility — all log lines are single-line JSON with level as a string label (not an integer), matching Promtail's label-extraction pipeline
• Config update (backend/src/config/index.ts) — LOG_LEVEL Zod enum updated from Winston's levels (http, verbose, silly) to Pino's levels (fatal, trace)
• Env example update (backend/.env.example) — comment clarifies the Pino level names

Tests

• 14 new unit tests in backend/src/middleware/__tests__/pinoLogger.test.ts covering:
  • Pino logger instance methods
  • correlationIdMiddleware — UUID generation, header propagation (X-Request-ID and X-Correlation-ID), req.log child logger attachment
  • createRequestLogger — response flow, health-check exclusion, status-level mapping
  • Stream-injection test verifying JSON log line structure and field names

Acceptance criteria

• Pino logger configured with log level from LOG_LEVEL env var
• Every HTTP request logs: method, path, status, duration, correlationId
• Correlation ID from X-Request-ID header or generated if absent
• Correlation ID passed to all downstream calls via req.log child logger
• Sensitive fields redacted (tokens, private keys)
• Logs shipped to Loki via Promtail (JSON format compatible with Promtail config)

Closes soterika#298