Add request IDs and structured logs

Useful logs answer which request failed, where, how long it took, and what the server decided.

Accept a valid incoming request ID or generate one, return it in a response header, and include it in structured logs. Record method, route, status, duration, and safe error classification. Redact sensitive headers and bodies.

Do not trust an arbitrary incoming identifier. Enforce a short length and safe character set, or replace it, so a caller cannot inject multiline log content or huge values. Log the route template such as /books/:id rather than a raw URL that may contain personal query data.

Place timing middleware around the whole request and emit the completion record even when a handler throws. Log an unexpected error once with its request ID and internal stack, then return a generic problem response carrying the same ID. Send one controlled failure and prove you can join the response header, completion log, and error log without searching for a title, token, or request body.

Add middleware that logs one JSON object after each request and one safe object for unexpected errors.