[rennf93]

Closes #110

The log lines the spec marks as DEBUG no longer print on every request. They go through the standard library's log/slog at debug level, so they are hidden by default, the way the other engines filter them, and an operator can turn them on with slog.SetLogLoggerLevel(slog.LevelDebug). No new config field and no new dependency.

Changed sites:

• logCountryCheckResult: the no_rules, no_geolocation and loopback_exempt verdicts (specs/02-config.md:174). The blocked, whitelisted and not_affected verdicts keep their configurable levels.
• The pipeline short-circuit line Request blocked by <check> (specs/03-pipeline.md:137). It carries check, path and method as slog attributes (specs/03-pipeline.md:179) and still respects muted_check_logs.
• The private-peer spoof notice in ipextraction.go, which was already tagged [debug].

I checked every DEBUG mandate in specs/*.md; these are the only ones. The configurable level knobs (log_request_level, log_suspicious_level, log_country_check_level) are unchanged.

Tests: TestSpecDebugLogsFollowSlogLevel fails on master (all five lines print at the default level) and passes here. It checks that nothing prints at the default level, that the lines and attributes appear at debug, and that muted_check_logs still silences the blocked-by line. gofmt, go vet, staticcheck, the unit and integration suites and the conformance suite pass locally. coverage_waivers.txt line numbers shift with the edits. The local coverage gate reports the same count on this branch as on clean master, so CI on Linux is the real check.

Found while wiring gin-guard into Ollama, where an unconfigured country check printed one line per request.