docs(governance): add backend logging and log-retention policy

[boalambo]

Linked Issue

Closes #2734

Description

What changed?

Added Governance/backend/LOG_RETENTION.md to define backend logging standards, including log levels, retention windows, and data protection rules. Updated Governance/README.md to link to the new document.

Why was it changed?

The Governance/ folder lacked a backend logging and log-retention policy document. This created a governance gap where contributors and maintainers had no clear, versioned reference for backend services governance in this area. Adding the document closes the gap and keeps the change self-contained within the Governance folder.

How was it implemented?

• Created Governance/backend/LOG_RETENTION.md with:
  • Log levels (DEBUG, INFO, WARNING, ERROR, CRITICAL)
  • Required log fields (timestamp, service name, request ID, etc.)
  • What must be logged (startup events, errors, critical failures)
  • What must never be logged (passwords, tokens, personal data, private keys)
  • Retention windows (30-365 days depending on log level)
  • Log storage and access controls
  • Ownership and review cadence (every 6 months)
  • Link to amendments process
• Updated Governance/README.md to include the new document in the governance index

---

Type of Change

• Documentation update

---

Test Evidence

This is a governance documentation change with no code modifications. The project's existing test suite was run to verify no regression:

npm test

Test output:

backend-changelog tests passed
All tests passed

---

Final Pre-Merge Checklist

• Branch is up to date with main / master
• Changes limited to maximum of two files in Governance folder
• No changes outside the Governance folder
• Follows existing governance document pattern (similar to AUDIT_LOGGING.md and ANONYMIZATION.md)
• Self-review completed

---

Additional Notes for Reviewer

This change is scoped to governance documentation only. No code changes, no behavior changes, and no regression risk. The document follows the same structure and conventions as other backend governance policies in the Governance/backend/ folder.

[drips-wave]

@boalambo Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[RUKAYAT-CODER]

Thank you for contributing to the project