feat(F-003): HTTP foundation with request context and error envelope

- request_id generated or sanitized-propagated on every request (x-request-id)
- structured JSON logging (pino), one correlated line per request, injectable logger
- error envelope v2 { error: { statusCode, code, message, details? }, requestId }
- 5xx messages always generic; stack traces stay in server logs only
- explicit parseJson (zod) input validation hook at the API layer
- README HTTP contract section; deps justified in spec/tech.md
- all gates approved; verify.sh green

project/README.md

@@ -19,6 +19,17 @@ npm run lint          # eslint + prettier check
 npm run lint:boundaries  # module boundary check
 ```
 
+## HTTP contract
+
+- Every response carries an `x-request-id` header (propagated from a safe incoming
+  `x-request-id`, or a fresh UUID). Every JSON log line for a request carries the same id.
+- Errors always use one envelope:
+  `{ "error": { "statusCode", "code", "message", "details?" }, "requestId" }`
+  Codes: `NOT_FOUND`, `VALIDATION_ERROR`, `BAD_REQUEST`/Fastify 4xx codes, `INTERNAL_ERROR`.
+  5xx messages are always generic; stack traces stay in server logs only.
+- Input validation is explicit per route: `parseJson(schema, body)` (zod) in the handler.
+- Log level via `LOG_LEVEL` env var (default `info`); logs are JSON only.
+
 ## Database (local dev)
 
 ```bash