feat(F-003): HTTP foundation with request context and error envelope

- request_id generated or sanitized-propagated on every request (x-request-id)
- structured JSON logging (pino), one correlated line per request, injectable logger
- error envelope v2 { error: { statusCode, code, message, details? }, requestId }
- 5xx messages always generic; stack traces stay in server logs only
- explicit parseJson (zod) input validation hook at the API layer
- README HTTP contract section; deps justified in spec/tech.md
- all gates approved; verify.sh green

work/artifacts/F-003/security.json

@@ -0,0 +1,27 @@
+{
+  "feature_id": "F-003",
+  "agent": "security",
+  "verdict": "APPROVED",
+  "summary": "Security gate passed. Header propagation sanitized against injection, no stack/internal leakage, log injection neutralized by JSON serialization, zero audit vulnerabilities with pino+zod.",
+  "checks": {
+    "dependencies": "PASS: npm audit -> 0 vulnerabilities; pino/zod justified in spec/tech.md",
+    "header_injection": "PASS: incoming x-request-id accepted only under ^[A-Za-z0-9._-]{1,128}$; newline and 129-char payloads replaced by UUID (regression tests present)",
+    "response_leakage": "PASS: 5xx path forces generic 'Internal Server Error'; body assertions confirm absence of thrown message and stack; 4xx exposes only safe messages/codes",
+    "log_injection": "PASS: requestId is pre-sanitized; url/method serialized via pino JSON encoding which escapes control characters",
+    "dangerous_patterns": "PASS: no eval / new Function / child_process in src"
+  },
+  "findings": [
+    {
+      "severity": "info",
+      "note": "Fastify 4xx codes exposed in envelope (e.g. FST_ERR_CTP_INVALID_JSON_BODY) are public framework codes; no internal state disclosed."
+    }
+  ],
+  "evidence": [
+    "npm audit -> found 0 vulnerabilities",
+    "grep eval|new Function over src -> none",
+    "grep x-request-id non-test usages -> only constant + sanitized generator path",
+    "5xx generic guard verified at build-app.ts lines 68/75",
+    "test 'internal errors never leak message or stack to the client' passes"
+  ],
+  "timestamp": "2026-08-14T20:14:00Z"
+}