refactor(web): replace eprintln! error logging with tracing/log

[dekobon]

Status: RESOLVED in fix/516-web-tracing-logging (commit 453805d).
bca-web now logs via tracing (error! for parse failures, warn!
for timeouts, each with a structured payload_id field) and wires
tracing-actix-web's TracingLogger middleware for per-request spans.
See the resolution comment for details.

---

Summary

bca-web logs server-side errors with eprintln! inside request handling:

• big-code-analysis-web/src/web/server.rs:107 —
  eprintln!("Parse task failed: {e}")
• big-code-analysis-web/src/web/server.rs:129

No log levels, timestamps, request correlation, or structured fields; the
output cannot be filtered or routed by a production log pipeline.

Suggested fix

Adopt tracing (or log + env_logger), emit at error!, and include the
request id already carried in the payload (payload.id). Wire actix's
TracingLogger/Logger middleware for request-level spans.

Pre-2.0 polish for the network service. Label: enhancement.

[dekobon]

Resolved in fix/516-web-tracing-logging (commit 453805d)

What changed

bca-web now logs via tracing instead of eprintln!:

• run_parse gained a payload_id: &str parameter carrying the
  client-supplied request id (payload.id). Parse failures log at
  error!, parse timeouts at warn!, each with payload_id as a
  structured field.

• TracingLogger middleware (tracing-actix-web) wraps the whole
  App (including the 404/415/405 fallback), producing a per-request
  span. FmtSpan::CLOSE turns each completed span into an access-log
  line — method, route, status, latency, plus the middleware's own
  request_id UUID. Sample:

  INFO HTTP request{http.method=POST http.route=/metrics ... request_id=fdee73b3-... http.status_code=200}: close time.busy=7.92ms
  

• Subscriber init in main: tracing_subscriber::fmt with
  EnvFilter (RUST_LOG, default info), installed before the server
  spawns so all worker threads inherit it. try_init() keeps the binary
  panic-free.

Design notes / findings during review

• Field naming. tracing-actix-web's span already emits a field
  literally named request_id (a UUID). Naming our payload field
  request_id too would have produced two same-named keys in structured
  output. The payload field is therefore payload_id, documented on
  run_parse.
• Timeout observability gap closed. The Err(_) timeout arm
  previously returned 504 and orphaned a blocking task with no
  server-side log at all. Since payload_id was already being threaded
  through, that path now logs at warn! with the request id and timeout —
  ops can correlate which request timed out and track orphan-pool pressure.
• Octet-stream endpoints carry no payload id, so they pass "";
  correlation falls back to the TracingLogger request span.
• HTTP responses are byte-for-byte unchanged — this is server-side
  observability only; no REST-schema change, no public Rust API break
  (run_parse is private; run/run_with_timeout signatures unchanged).

Tests

Three #[traced_test] assertions added and each verified via
test-via-revert (they fail when the corresponding log line is removed):

• error path logs Parse task failed + payload_id + the underlying
  panic detail (while assert_error_sanitized proves that same detail is
  scrubbed from the HTTP body);
• timeout path logs Parse timed out + payload_id.

Validation

make pre-commit green: cargo fmt / clippy ×2 / workspace tests /
cargo +nightly udeps / doc / markdown+TOML+shell+Makefile+actionlint /
man-page drift / self-scan hard+headroom gates / 191 Python tests.
Quality passes run: simplify-rust, rust-optimize, audit-tests,
code-review, review.