feat: structured JSON logging with request id tracing

[Nwapu-TrustJah]

Overview

This PR replaces interpolated console.warn prose with structured JSON logging — one object per line carrying level, event, route, status and duration — and threads a single request id from the inbound request through the provider call so one user's report can be traced end to end. It also adds a test that asserts no logged line ever contains a NIN, an API key or a connection string, and documents in the README how to find one user's requests from a support report.

Related Issue

Changes

🧱 Structured Logger

• [ADD] src/logger.ts

  • Emits one JSON object per line with level, event, route, status and durationMs.
  • Accepts an optional request id so every line tied to a request carries the same id.
  • Redacts known-sensitive keys (NIN, API key, connection string, account number) before serialization so the careful omissions in the existing code stay easy to keep.

• [ADD] src/middleware/requestId.ts

  • Assigns a request id on inbound requests (honouring an inbound header when present) and exposes it on the request so downstream provider calls reuse the same id.

• [MODIFY] src/index.ts

  • Wires the request-id middleware into the Express app and routes existing console.warn call sites through the structured logger, including the provider call path so each provider call logs one line with route, status and elapsed ms.

• [ADD] src/__tests__/logger.test.ts

  • Asserts logged lines are valid JSON with the required fields.
  • Asserts no logged line contains a NIN, an API key or a connection string.
  • Asserts a single request id is present across the API and provider boundary for one request.

Verification Results

npm test
✅ logger suite passes
⚠️ src/__tests__/openapiCoverage.test.ts remains red — pre-existing on main (W082), not touched here

Acceptance Criteria	Status
Every provider call logs one line with route, status and elapsed ms	✅ Provider call path emits a single structured line with route, status, durationMs
A test asserts no logged line contains a NIN, an API key or a connection string	✅ src/__tests__/logger.test.ts asserts redaction across captured lines
A single request can be followed across the API and provider boundary by one id	✅ Request id set in middleware and reused on provider log lines
The README says how to find one user's requests from a support report	✅ README documents filtering by request id from a support report

Closes #240

[drips-wave]

@Nwapu-TrustJah Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits