feat: add structured logging, API metrics, request tracing, and audit logs

[mighty840]

Summary

• Replace all console.* calls with pino structured logger (JSON in prod, pretty in dev, silent in test)
• Add request ID middleware (x-request-id header) for end-to-end tracing
• Add pino-http middleware replacing morgan for HTTP request logging
• Add API metrics collector that records per-request metrics (method, path, status, response time) to a new ApiMetric table
• Add audit log system with fire-and-forget auditLog() helper used across 8 controllers (staff, menu-item, category, order, coupon, settings, location, automation)
• Add Developer API endpoints: GET /api/developer/metrics, GET /api/developer/metrics/endpoints, GET /api/developer/audit-logs
• Add Admin > Developer > API Metrics page with time range selector, stat cards, request/response time charts (Recharts), and top endpoints table
• Add Admin > Developer > Audit Log page with entity/action/search filters and paginated table
• Metrics visible to MANAGER+, audit log restricted to SUPER_ADMIN only

Closes #14

Test plan

• Run npx prisma migrate dev — migration creates api_metrics and audit_logs tables
• Start server — structured JSON/pretty logs appear, no console.* output
• Make HTTP requests — verify x-request-id response header present
• Check api_metrics table has rows after requests
• Perform admin actions (create/update/delete menu items, etc.) — verify audit_logs table has rows
• Log in as MANAGER — Developer > API Metrics page shows charts and endpoint data
• Log in as SUPER_ADMIN — Developer > Audit Log page shows entries
• Log in as MANAGER — Audit Log route redirects (SUPER_ADMIN only)
• Log in as STAFF — Developer section not visible in nav

🤖 Generated with Claude Code