feat: structured access logging and distributed log tracing

[hansent]

Summary

• Adds structured access log middleware (gated behind API_LOGGING_ENABLED) replacing uvicorn's unstructured access log with JSON entries containing method, path, status_code, request_id, and all response header values
• Adds execution_id to structlog output so every log entry includes the distributed trace ID — enables cross-service log correlation when using remote workflow execution
• Propagates ASGI correlation_id into worker threads so logs from workflow steps in ThreadPoolExecutor include request_id
• Adds execution_id to CORS expose_headers

How tracing works

Within a service: All logs (including from worker threads) now include request_id for per-request correlation.

Across services (CPU primary → GPU workers): All logs include execution_id which is already forwarded to remote workers via SDK headers. Search GCP logs by execution_id to see all entries across all services for a request.

Example structured access log entry (GCP)

{
  "message": "access",
  "severity": "INFO",
  "request_id": "a1b2c3d4e5f6",
  "execution_id": "1740631234567890123_abc1",
  "method": "POST",
  "path": "/model-id/1",
  "status_code": 200,
  "processing_time": "1.234",
  "model_cold_start": "false",
  "model_id": "model-id/1",
  "workspace_id": "my-workspace"
}

Test plan

• Unit test: correlation_id propagation into worker threads
• All existing context propagation tests pass (7/7)
• All model load collector and base manager tests pass (47/47)
• Manual: API_LOGGING_ENABLED=True → verify structured JSON access log with all fields
• Manual: verify no duplicate uvicorn access log line
• Manual: verify api_key never appears in logs

🤖 Generated with Claude Code