feat: add request correlation skill

[robhowley]

• Every request or job must produce a traceable log story with a single correlation ID
• Store correlation in contextvars — never on request objects or as function arguments
• Wire correlation at every entrypoint — HTTP middleware, job workers, and CLI tasks
• Read x-request-id from inbound requests; generate one if absent
• Echo the correlation ID back on the response via x-request-id
• Inject correlation into every log record automatically via a logging filter
• Log exceptions exactly once at system boundaries — services raise, they don't log
• Propagate correlation to all outbound HTTP calls via request headers
• Propagate correlation explicitly to background jobs — pass it, don't assume inheritance
• Use copy_context() when spawning async tasks; never assume context is inherited across boundaries
• Centralize all correlation infrastructure in app/observability/ — never duplicate it
• Never log secrets, tokens, auth headers, or session IDs