feat(observability): structured logs, W3C trace IDs, Sentry hooks (#18)

- TS: pino + pino-http; every HTTP request log includes traceId from
  W3C traceparent header (generated if absent); forwarded to ml/serving
  on all /score, /generate, /reward, and /api/ml proxy calls
- Python: structlog JSON; FastAPI middleware binds trace_id via
  contextvars so every log line within a request carries it
- Sentry: optional SENTRY_DSN init in both runtimes (no-op if unset)
- Replace all console.* calls across services/api with pino logger
- Update tests to spy on logger instead of console

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

services/api/src/events/nats.ts

@@ -12,6 +12,7 @@
 
 import type { NatsConnection, JetStreamClient, StreamConfig } from 'nats';
 import { bus } from './bus.js';
+import { logger } from '../logger.js';
 
 let nc: NatsConnection | null = null;
 let js: JetStreamClient | null = null;
@@ -67,13 +68,13 @@ export async function connectNats(natsUrl: string): Promise<void> {
       if (!js) return;
       const data = new TextEncoder().encode(JSON.stringify(payload));
       js.publish(subject, data).catch((err: Error) =>
-        console.error(`[nats] publish failed for ${subject}: ${err.message}`),
+        logger.error({ err, subject }, 'nats publish failed'),
       );
     });
 
-    console.log(`[nats] connected to ${natsUrl}, streams: ${STREAMS.map((s) => s.name).join(', ')}`);
+    logger.info({ url: natsUrl, streams: STREAMS.map((s) => s.name) }, 'nats connected');
   } catch (err: any) {
-    console.warn(`[nats] connection failed — running without JetStream: ${err.message}`);
+    logger.warn({ err }, 'nats connection failed — running without JetStream');
   }
 }