feat: add structured logging with Winston, Morgan, and request correlation IDs

[bh462007]

Description

Fixes #426.

This PR introduces a centralized and structured logging system by replacing the existing ad-hoc console.log/console.error usage and manual request logging with Winston for application logs, Morgan for HTTP access logs, and request correlation IDs for improved traceability.

Changes

backend/config/logger.js (new)

• Added a centralized Winston logger.
• Configured log levels via the LOG_LEVEL environment variable (defaults to info).
• Uses colorized, human-readable output in development and JSON output in production.

backend/middleware/requestId.js (new)

• Added middleware that generates a unique request ID using crypto.randomUUID().
• Attaches the ID to req.id.
• Returns the request ID to clients through the X-Request-Id response header.

backend/app.js

• Registered the request ID middleware early in the middleware stack.
• Replaced the manual request logger with Morgan.
• Configured Morgan to log HTTP method, path, status code, response time, and request ID.
• Routed Morgan output through the centralized Winston logger.

backend/index.js

• Removed the manual development request logger.
• Replaced startup console.log statements with logger.info.
• Removed duplicate route registrations so app.js remains the single source of truth for application routes and middleware.

backend/config/db.js

• Replaced database connection console.log/console.error statements with the centralized logger.

backend/routes/bot.js

• Removed log statements that exposed the Gemini API key.
• Replaced raw error logging with structured logger.error() messages containing the request ID and error message only.

Remaining backend files

• Replaced all remaining console.log and console.error statements throughout the backend with the centralized Winston logger to provide consistent logging across the application.

Testing

Verified locally that:

• ✅ Server startup logs are emitted through Winston instead of raw console.log.
• ✅ Database connection success and failure logs use the centralized logger.
• ✅ HTTP requests are logged through Morgan with method, path, status code, response time, and request ID.
• ✅ The X-Request-Id response header matches the correlation ID shown in the corresponding log entries.
• ✅ Triggering an invalid Gemini API key error produces a structured logger.error entry without exposing any secrets.
• ✅ Confirmed no API keys, passwords, authentication tokens, or other sensitive information are written to the logs.
• ✅ Verified all previous console.log and console.error usages have been replaced with the centralized logger.
• ✅ Re-tested authentication, product listing, and other existing endpoints to confirm there are no functional regressions.

Branch Note

This branch is based on fix/415-index-startup-crash because main currently cannot start the server (see #415). Once #415 is merged, this branch can be rebased onto the updated main, which will remove the unrelated startup-fix changes from this PR.

Checklist

• HTTP requests are logged via Morgan with method, path, status, response time, and request ID
• Application logs use the centralized Winston logger instead of raw console.log/console.error
• Log level is configurable through the LOG_LEVEL environment variable
• No secrets (API keys, passwords, tokens, etc.) are logged
• Each request includes a correlation ID that is present in related log entries and the response header

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.