feat(gateway): generate and propagate X-Correlation-Id (GrantFox FWC26)

[vally111]

• Mount correlationMiddleware on the gateway router so every /api/gateway request resolves an X-Correlation-Id (from client header → req.id → UUID v4)
• Forward x-correlation-id alongside x-request-id in all outbound upstream fetch calls so multi-hop request chains are fully traceable
• Attach req.correlationId for downstream handlers and structured logging
• Set X-Correlation-Id response header so callers can correlate request chains
• Declare req.correlationId on Express.Request in express.d.ts
• Add focused test suite in gatewayRoutes.test.ts covering:
  • Response header always present (including 401/402/429 short-circuits)
  • Client-supplied header echoed exactly
  • Fallback to X-Request-Id when no correlation header is provided
  • UUID generated when neither header is present
  • Outbound upstream headers carry x-correlation-id
  • Independent propagation of request-id and correlation-id
  • Oversized header sanitisation (>128 chars falls back to req.id)
  • Control-character stripping (header injection prevention)
  • Response/outbound consistency

Closes #897

[drips-wave]

@vally111 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[greatest0fallt1me]

Merged into main via admin resolver (-X theirs).

[greatest0fallt1me]

CI passed, solid PR — merged.