feat(logging): implement per-request logging middleware with access log

Signed-off-by: Noooste <83548733+Noooste@users.noreply.github.com>

backend/pkg/logger/ctx.go

@@ -18,12 +18,13 @@ func IntoCtx(ctx context.Context, l zerolog.Logger) context.Context {
 
 // FromCtx returns the logger bound to ctx. If no logger is bound (e.g. the
 // call is outside any middleware, or ctx is nil), it returns the global
-// logger. Never returns a zero-value zerolog.Logger.
-func FromCtx(ctx context.Context) zerolog.Logger {
+// logger. Never returns nil.
+func FromCtx(ctx context.Context) *zerolog.Logger {
 	if ctx != nil {
 		if l, ok := ctx.Value(ctxKey{}).(zerolog.Logger); ok {
-			return l
+			return &l
 		}
 	}
-	return Get().Logger
+	l := Get().Logger
+	return &l
 }

backend/pkg/logger/redact.go

@@ -0,0 +1,22 @@
+package logger
+
+// redactThreshold is the minimum length at which partial visibility is shown.
+// Below this, the entire value is replaced with "***" because first-4/last-4
+// would leak too much of short strings.
+const redactThreshold = 12
+
+// RedactKey returns a partially-visible form of a non-secret identifier
+// (access key ID, user ID, etc.) showing first 4 and last 4 characters.
+// Shorter values are fully redacted to avoid over-exposure.
+func RedactKey(s string) string {
+	if len(s) < redactThreshold {
+		return "***"
+	}
+	return s[:4] + "…" + s[len(s)-4:]
+}
+
+// RedactToken returns "***" for any secret (passwords, bearer tokens, JWT,
+// client secrets). Secrets must never be partially visible in logs.
+func RedactToken(s string) string {
+	return "***"
+}