feat(middleware): add RequestLogger for structured access logs

[kellylimmm]

Links #132

🚀 Summary

Adds a RequestLogger HTTP middleware that emits one structured JSON access-log entry per request. This gives the platform visibility into traffic patterns, latency, and server errors without relying on per-handler logging, and ensures every request can be traced end-to-end via the existing request_id correlation.

✏️ Changes

• Added RequestLogger middleware (server/internal/middleware/request_logger.go) that logs method, path, status, and duration_ms per request.
• Added responseRecorder to capture the response status code via http.ResponseWriter interception.
• 5xx responses log at Error level so monitoring tooling can alert on server errors directly from log levels.
• Wired RequestLogger into the middleware chain in server/cmd/tw/main.go immediately after RequestID, so every access log entry inherits the request_id field.
• Added unit tests covering success, default-200 path, multiple WriteHeader calls, implicit 200 via Write, 5xx → ERROR level, and 4xx (non-5xx) → INFO level.

🧪 Test Plan

• go test ./server/internal/middleware/... — all subtests pass.
• go build ./... — clean build.
• go vet ./... — no issues.
• Manual: ran go run ./server/cmd/tw and exercised:
  • GET / → INFO log line with status:200.
  • POST /otp/request with invalid body → INFO log line with status:422.
  • Confirmed the X-Request-Id header on each response matches the request_id field in the corresponding log entry.