Closes #96.

Replaces ad-hoc console.* calls with a structured logger and per-request correlation.

Changes

• src/lib/server/logger.ts — a pino logger writing structured JSON to stdout, level from LOG_LEVEL (default info). No transport, so it stays robust under the bundled adapter-node server.
• src/hooks.server.ts
  • Derives a request id per request (reuses a sanitised inbound X-Request-Id, else mints one), attaches a child logger to event.locals.log, and echoes X-Request-Id on the response.
  • Logs each request (method, path, status, durationMs) — skipping the /health and /readyz probes to avoid noise.
  • Adds a handleError hook that logs unhandled server errors with the request id + stack.
• app.d.ts — Locals now carries requestId and log.
• Migrated the existing console.* sites: services/dns-verification.ts (→ base logger) and api/csp-report/+server.ts (→ locals.log).

Notes

• pino is a runtime dependency (imported by server code); the production image already ships node_modules, so it resolves at runtime.
• The existing dns-verification unit test asserted on console.error; it's been retargeted to the logger mock (same intent — errors are logged with orgId / domain / code). The message field is now err.
• No pretty-print transport is wired in (transports spawn worker threads that are awkward under the bundled server). Structured JSON is the intended prod format; pipe through pino-pretty locally if desired.