API: standardized structured JSON logging with levels and sampling

[Depo-dev]

Summary

Standardise structured JSON logging across the Go API with consistent fields and level-based sampling.

Background & current behaviour

Handlers use slog unevenly (some slog.Error, some slog.ErrorContext), with inconsistent fields. There is no single logger config, no guaranteed request-id/key-id fields, and no sampling for hot paths.

Why this matters for MVP

Consistent, queryable logs are essential for operating the service. Ad-hoc logging makes incident response slow and risks leaking secrets.

Proposed implementation

1. Configure a single JSON slog handler at startup; inject common fields (service, level, request_id, api_key_id, route, status, latency_ms) via context/middleware.
2. Guarantee raw API keys / secrets are never logged (redaction + a test).
3. Add level-based sampling for high-volume debug logs.
4. Document the log schema.

Acceptance criteria

• Single logger config; consistent fields across handlers/middleware.
• Raw keys/secrets never logged (verified by a test).
• Sampling for high-volume debug logs.
• Documented log schema.

Affected files / components

• services/api/main.go (logger setup)
• services/api/middleware/ (field injection)

Testing & verification

A test capturing log output and asserting fields + absence of secrets; sampling unit test.

Related / dependencies

Feeds log/trace correlation (#294) and request-id (#226).

Out of scope

Log shipping/aggregation infrastructure.

---

Target branch

All work for this issue MUST target the dev branch. Cut your feature branch from dev and open the pull request against dev, never against main. Any PR opened against main for this issue will be closed and asked to re-target dev.