feat(F-003): HTTP foundation with request context and error envelope

- request_id generated or sanitized-propagated on every request (x-request-id)
- structured JSON logging (pino), one correlated line per request, injectable logger
- error envelope v2 { error: { statusCode, code, message, details? }, requestId }
- 5xx messages always generic; stack traces stay in server logs only
- explicit parseJson (zod) input validation hook at the API layer
- README HTTP contract section; deps justified in spec/tech.md
- all gates approved; verify.sh green

backlog/features.json

@@ -124,12 +124,12 @@
         "Internal stack traces never leak to API responses",
         "verify.sh green"
       ],
-      "status": "pending",
+      "status": "done",
       "created_at": "2026-08-14",
       "gates": {
-        "review": false,
-        "security": false,
-        "qa": false
+        "review": true,
+        "security": true,
+        "qa": true
       }
     },
     {