feat(F-003): HTTP foundation with request context and error envelope

- request_id generated or sanitized-propagated on every request (x-request-id)
- structured JSON logging (pino), one correlated line per request, injectable logger
- error envelope v2 { error: { statusCode, code, message, details? }, requestId }
- 5xx messages always generic; stack traces stay in server logs only
- explicit parseJson (zod) input validation hook at the API layer
- README HTTP contract section; deps justified in spec/tech.md
- all gates approved; verify.sh green

work/artifacts/F-003/leader-close.json

@@ -0,0 +1,35 @@
+{
+  "feature_id": "F-003",
+  "agent": "leader",
+  "verdict": "APPROVED",
+  "summary": "F-003 closed. HTTP foundation in place: request_id everywhere (generated or sanitized-propagated), JSON structured logs correlated per request, stable error envelope v2, explicit validation hook. All gates APPROVED, verify.sh exit 0.",
+  "gates": {
+    "reviewer": "APPROVED (reviewer.json)",
+    "security": "APPROVED (security.json)",
+    "qa": "APPROVED (qa.json)",
+    "verify_sh": "exit 0"
+  },
+  "deliverables": [
+    "src/infrastructure/logging/logger.ts (pino factory, injectable destination)",
+    "src/shared/errors.ts (AppError + error envelope v2)",
+    "src/shared/http-input.ts (parseJson zod hook)",
+    "src/app/build-app.ts (genReqId sanitization, onRequest/onResponse hooks, error+notFound handlers)",
+    "src/infrastructure/http/server.ts (logger-based startup)",
+    "12 new tests across shared + app composition; README HTTP contract section",
+    "spec/tech.md pino+zod justification"
+  ],
+  "process_notes": [
+    "Doc stage bounced to build to write README (project/ gated to build/implementer/running). This is the correct guardrail behavior."
+  ],
+  "next_feature_hint": "F-004 (config/flags) only depends on F-001; F-005 identity needs F-002+F-003, both now done -> F-005 unblocked",
+  "evidence": [
+    "work/artifacts/F-003/architect.md",
+    "work/artifacts/F-003/implementer.md",
+    "work/artifacts/F-003/reviewer.json",
+    "work/artifacts/F-003/security.json",
+    "work/artifacts/F-003/qa.json",
+    "work/artifacts/F-003/documenter.md",
+    "./scripts/verify.sh exit 0 at close"
+  ],
+  "timestamp": "2026-08-14T20:18:00Z"
+}