No structured logging — morgan 'combined' format only, no correlation IDs

[ndii-dev]

app.use(morgan("combined")) is the entire logging story: unstructured Apache-format access logs with no request-correlation ID threading through to the errorHandler's console.error(err), making it impossible to correlate a specific failed /wallet/send with its corresponding Horizon interaction in the logs during an incident. Implement structured, correlated logging.

Definition of done:

• Every request gets a correlation/request ID, propagated into any error logging for that request
• Logs are structured (JSON) for machine parsing, not just morgan's text format
• Confirmed no secret material (sourceSecretKey, generated secretKey) ever appears in any log line, including error logs

---

Before opening a PR for this issue, read CONTRIBUTING.md.

This is not a starter-issue. The Definition of done above is the full
acceptance criteria, not a subset to sample from — a PR that addresses part
of it is an unfinished issue, not a smaller one. Your PR must include, in
the PR description itself:

• Root cause / design-decision rationale in your own words — not a restatement of this issue
• Every Definition of done bullet above addressed explicitly, with a one-line note on how
• Evidence the code actually runs: pasted test/build output, a screen recording or before/after screenshots for UI changes, or real (non-mocked) logs for network/contract-facing work
• New or updated tests included and shown passing (paste the output)
• Any adjacent/related behavior this issue calls out re-verified, not assumed unaffected

PRs missing these will be sent back before review, not reviewed and rejected — please do this up front.