Update Phase 5 quality, observability, and API error handling

[rgomids]

Summary

• standardize API validation and error responses with semantic error codes and correlation_id
• add correlation propagation, structured logging sanitization, OpenTelemetry spans, and Prometheus-style metrics via GET /metrics
• add pagination and supporting indexes for audit log and organization membership queries
• expand unit, integration, and functional coverage for authorization, audit flows, validation, and observability
• update Phase 5 documentation, commands, changelog, and ADRs

Testing

• npm run lint
• npm run build
• npm run test:unit
• npm run test:integration (skipped locally: Docker/Testcontainers unavailable)
• npm run test:functional (skipped locally: Docker/Testcontainers unavailable)