Add structured backend logging with pino

Wires leveled, structured logging (pretty in dev, JSON in prod) through
the server lifecycle, HTTP/WS request handling, run engine, auth, db,
and config loading. CLI command output is left untouched since it's
user-facing terminal UX, not backend logs.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/app/api/auth/login/route.ts

@@ -11,6 +11,9 @@ import {
   recordFailedAttempt,
   clearAttempts,
 } from "@/lib/auth/rate-limit";
+import { logger } from "@/lib/logger";
+
+const log = logger.child({ mod: "auth" });
 
 const loginSchema = z.object({
   username: z.string().min(1),
@@ -20,6 +23,7 @@ const loginSchema = z.object({
 export async function POST(request: Request) {
   const rateLimitKey = request.headers.get("x-forwarded-for") ?? "local";
   if (isRateLimited(rateLimitKey)) {
+    log.warn({ from: rateLimitKey }, "login rate-limited");
     return Response.json(
       { error: "Too many attempts, try again later." },
       { status: 429 },
@@ -44,6 +48,10 @@ export async function POST(request: Request) {
     !(await verifyPassword(user.passwordHash, parsed.data.password))
   ) {
     recordFailedAttempt(rateLimitKey);
+    log.warn(
+      { from: rateLimitKey, username: parsed.data.username },
+      "login failed: invalid credentials",
+    );
     return Response.json({ error: "Invalid credentials" }, { status: 401 });
   }
 
@@ -58,5 +66,7 @@ export async function POST(request: Request) {
   session.username = user.username;
   await session.save();
 
+  log.info({ from: rateLimitKey, username: user.username }, "login succeeded");
+
   return Response.json({ user: { username: user.username } });
 }