feat(api): assign and echo request ids

ts/api/server.ts

@@ -123,6 +123,7 @@ export class ApiServer {
     res: http.ServerResponse,
   ): Promise<void> {
     const startTime = Date.now();
+    const requestId = this.ensureRequestId(req, res);
 
     // Set CORS headers if enabled
     if (this.config.cors) {
@@ -177,7 +178,7 @@ export class ApiServer {
     // Log request
     const duration = Date.now() - startTime;
     this.recordRequest(path, res.statusCode);
-    logger.dim(`${req.method} ${path} - ${res.statusCode} (${duration}ms)`);
+    logger.dim(`[${requestId}] ${req.method} ${path} - ${res.statusCode} (${duration}ms)`);
   }
 
   /**
@@ -405,6 +406,20 @@ export class ApiServer {
     metric.set(path, (metric.get(path) || 0) + 1);
   }
 
+  private ensureRequestId(req: http.IncomingMessage, res: http.ServerResponse): string {
+    const existing = typeof req.headers['x-request-id'] === 'string'
+      ? req.headers['x-request-id']
+      : undefined;
+    const requestId = existing || this.generateRequestId();
+    req.headers['x-request-id'] = requestId;
+    res.setHeader('X-Request-Id', requestId);
+    return requestId;
+  }
+
+  private generateRequestId(): string {
+    return `req-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+  }
+
   private escapeMetricLabel(value: string): string {
     return value.replaceAll('\\', '\\\\').replaceAll('"', '\\"');
   }