Add request IDs and structured (JSON) logging

[timpara]

Context

Behind a reverse proxy, correlating proxy logs with app logs requires a shared request ID. Logs today are plain-text via the root logger.

Proposal

• Accept `X-Request-ID` from the proxy (falling back to `uuid4()`) and stash it on `flask.g`.
• Add a before/after request hook that logs method, path, status, latency, remote addr, request id.
• Optional: JSON formatter gated on `LOG_FORMAT=json` env var.
• Caddy/Traefik overlays updated to propagate `X-Request-ID`.

Acceptance

• `docker compose logs` shows one JSON line per request with a stable `request_id`.
• Correlates with Caddy's access log.