Fix/serialization lb body logging key rotation

[Alaka-ibr]

Summary

Fixes the four reported backend issues covering serialization, load balancing, request logging, and API key rotation.

Closes #479
Closes #484
Closes #485
Closes #486

Changes

#479 - Data serialization inconsistencies

• Added a shared JSON replacer for every Express response.
• Dates serialize consistently as ISO-8601 strings.
• BigInt values serialize as strings instead of throwing.
• Removed environment-dependent JSON formatting.
• All endpoints using res.json() now follow the same serialization rules.

#484 - No load balancing

• Added deploy/nginx.conf with nginx least_conn load balancing.
• Added deploy/docker-compose.prod.yml running three API replicas behind nginx.
• Preserves WebSocket upgrade headers and forwarded client IP headers.
• All replicas share Redis and PostgreSQL.
• Leader election continues to keep scheduled jobs on a single instance.

Start the production stack with:

docker compose -f deploy/docker-compose.prod.yml up --build --scale api=3

#485 - Logging does not capture request body

• Request logs now include a sanitized request_payload.
• Passwords, tokens, API keys, authorization headers, cookies, and webhook secrets are redacted.
• Multipart uploads and binary bodies are skipped.
• Logged payloads are truncated to 4096 characters.
• Redaction reuses the existing log redaction service.

#486 - No API key rotation mechanism

• POST /api/v1/keys/:id/rotate issues a replacement key and retires the previous key.
• Previous keys are revoked immediately by default.
• API_KEY_ROTATION_GRACE_SECONDS enables a bounded overlap window for zero-downtime client deployment.
• grace_period_seconds can override the grace window for a single rotation.
• Rotated records track rotated_at, rotated_from, rotated_to, and rotation_count.
• Expired keys are rejected and cleaned up during validation.
• Expired keys are omitted from key listings.

New environment variable

Variable	Default	Purpose
API_KEY_ROTATION_GRACE_SECONDS	0	How long the previous API key remains valid after rotation

Test plan

• Added unit coverage for the new serialization, logging, rotation, and deployment behavior.
• Syntax-checked all changed JavaScript files.
• Run npm test before merging.

[drips-wave]

@Alaka-ibr Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits