backend observability

[Kaylahray]

Summary

closes #132

Improve backend observability for campaign traffic, wallet auth flows, and payment reconciliation by adding request tracing, correlation IDs, structured JSON logging, and slow-call detection across HTTP handlers and background workers.

Changes

Core observability infrastructure

• Add ObservabilityModule with:
  • CorrelationIdMiddleware — reads or generates X-Correlation-ID, echoes it on responses
  • RequestContextService — AsyncLocalStorage-based context propagation (correlationId, traceId, workerRunId, workerName)
  • StructuredLogger — JSON logs with automatic context fields
  • LoggingInterceptor — structured HTTP request start/complete/error logs
  • HttpExceptionFilter — error responses include correlationId and traceId
  • traceAsync() utility — spans for network/database calls with span.slow warnings

Domain instrumentation

• Auth — structured logs for nonce issuance and verify start/success/failure (with failure reasons)
• Invoices — structured invoice.created event on invoice creation
• Horizon watcher — worker context per poll tick, child context per tx (horizon:<txHash>), traced Horizon/Soroban network calls
• Soroban events worker — worker context per tick, child context per event (soroban:<eventId>), traced RPC getEvents calls

Database & network slow-call tracing

• Prisma middleware logs db.query.slow when queries exceed threshold
• Network spans log span.slow for Horizon and Soroban RPC calls above threshold
• Configurable via SLOW_DB_THRESHOLD_MS (default 200) and SLOW_NETWORK_THRESHOLD_MS (default 500)

Frontend propagation

• Web apiClient sends X-Correlation-ID on every request
• CORS updated to allow/expose correlation headers

Acceptance criteria

• Logs can be correlated across async jobs via correlationId, traceId, and workerRunId
• Traces highlight slow database or network calls via db.query.slow and span.slow events

Test plan

• npm run build passes
• Full test suite passes (npm test — 19 suites, 133 tests)
• New unit tests for RequestContextService and traceAsync
• Manual: trigger auth flow and confirm JSON logs share correlationId with response header
• Manual: create invoice and confirm invoice.created structured log
• Manual: simulate slow Horizon/Soroban/DB calls and confirm span.slow / db.query.slow warnings