feat(ops): structured JSON logging with request correlation IDs

[trinhvandat]

Context (P1 — operability)

Logs are plain-text with no request correlation — debugging multi-tenant production issues across requests is guesswork.

Scope

• Servlet filter generating/propagating a request ID (X-Request-Id honored if present) into SLF4J MDC; include user id / environment key id when authenticated
• Logback JSON encoder (logstash-logback-encoder) active in prod profile; human-readable pattern (with request ID) in dev
• Request ID returned in error responses from GlobalExceptionHandler

Acceptance criteria

• Every log line in prod profile is JSON with requestId, and userId/envId when available
• Error responses carry the requestId for support correlation
• Filter ordered before both security chains; MDC cleared after each request (test for leakage across requests)