Add a request-id header to all API responses

[100rd]

Problem

API responses have no correlation id, so tracing a request across logs is hard.

What

Attach an X-Request-Id (uuid) to every response; log it with each request line.

Acceptance criteria

• every HTTP response carries an X-Request-Id header (uuid v4)
• the id appears in the structured request log line
• a unit test asserts the header is present