Add consistent API request logging and a themed 404 page, bump to 0.4.0

Every app/api route handler now goes through withRouteLogging, which logs
a correlated reqId/method/path/status/duration for each request and turns
any uncaught error into a logged stack trace plus a clean JSON 500 instead
of Next's default opaque failure. proxy.ts logs rejected auth attempts, and
instrumentation.ts's onRequestError catches anything that still escapes a
route handler. Also adds a minimal not-found page matching the app's card
styling.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

app/api/devices/[id]/route.ts

@@ -1,16 +1,20 @@
 import { NextResponse } from "next/server";
 import { z } from "zod";
 import { renameDevice } from "@/lib/db/queries/devices";
+import { withRouteLogging } from "@/lib/api/with-route-logging";
 
 const bodySchema = z.object({ displayName: z.string().min(1).max(120) });
 
-export async function PATCH(req: Request, { params }: { params: Promise<{ id: string }> }) {
-  const { id } = await params;
-  const parsed = bodySchema.safeParse(await req.json().catch(() => null));
-  if (!parsed.success) {
-    return NextResponse.json({ error: "displayName is required" }, { status: 400 });
-  }
-  const updated = await renameDevice(Number(id), parsed.data.displayName);
-  if (!updated) return NextResponse.json({ error: "not found" }, { status: 404 });
-  return NextResponse.json({ device: updated });
-}
+export const PATCH = withRouteLogging(
+  "devices.rename",
+  async (req: Request, { params }: { params: Promise<{ id: string }> }) => {
+    const { id } = await params;
+    const parsed = bodySchema.safeParse(await req.json().catch(() => null));
+    if (!parsed.success) {
+      return NextResponse.json({ error: "displayName is required" }, { status: 400 });
+    }
+    const updated = await renameDevice(Number(id), parsed.data.displayName);
+    if (!updated) return NextResponse.json({ error: "not found" }, { status: 404 });
+    return NextResponse.json({ device: updated });
+  },
+);