feat: per-clone observability - logging middleware + /metrics + correlation id (bounty #9)

[Kasuki354]

Summary

Implements bounty #9: Per-clone observability (logs + /metrics + middleware)

Changes

1. Request logging middleware:

• onRequest hook: logs request.start with method, url, requestId
• onResponse hook: logs request.end with statusCode, durationMs, requestId
• Every log line includes correlation id (from x-request-id header or auto-generated)

2. Per-clone event counters:

• In-memory counters object keyed by clone slug -> event name -> count
• bumpCounter() called at every significant event: poll_created, vote_counted, vote_idempotent_replay, vote_key_conflict, vote_already_voted
• All counters exposed in /metrics as Prometheus-style gauges

3. Enhanced /metrics endpoint:

• Base metrics preserved: openbuild_clones_total, openbuild_polls_total, openbuild_votes_total
• New per-clone metrics: openbuild_{clone}_{event}_total for every event that fired
• Correct Prometheus format with HELP and TYPE lines

4. Enhanced error handler:

• Logs validation errors with requestId and url
• Logs unhandled errors with requestId

The invariant

The reviewer can see the invariant events (vote.counted, vote.idempotent_replay, vote.already_voted) in the logs, correlated by request id.

Tests

• /metrics returns prometheus format with base counters
• /metrics includes per-clone event counters after activity
• x-request-id header is accepted and used
• Auto-generated request id when none provided
• /healthz still works
• No regression: single vote counts, 50 concurrent same-voter votes still exactly 1 + 49 x 409 + zero 5xx

Resolves #9