Backend request correlation IDs: test coverage

[Ejere]

closes #1322

correlationIdMiddleware and requestLogger already implemented backend request correlation IDs (generation, inbound-header propagation with validation bounds, response-header echoing, and inclusion in access and error logs plus the error response body) fully and correctly on dev, but had zero test coverage, which was the actual remaining gap against this issue's acceptance criteria ("tests or documented verification prove the behavior").

correlationId.test.ts (11 tests): fresh correlation ID and request ID generated when no header is sent; a valid inbound X-Correlation-Id is honored verbatim; X-Request-Id is always freshly generated per hop even when a client sends one (never forwarded, so two hops of the same correlated trace still get distinct request IDs); the 8-128 character validation bounds (rejects too-short, rejects too-long, accepts at each exact boundary); whitespace is trimmed from a valid ID; an all-whitespace ID is rejected; getCorrelationId/getRequestId return undefined before the middleware has run.

requestLogger.test.ts (8 tests): the access log line includes method, path (including query string), status, and a non-negative duration; non-2xx statuses are logged as info, not misclassified as an error; the correlation ID and request ID attached by correlationIdMiddleware appear in the log line; errorHandler's JSON response body and error log line both carry the correlation/request IDs; a thrown Error's name/message are logged, with a generic fallback shape for a non-Error thrown value; errorHandler does not attempt a second response (and does not throw "Cannot set headers after they are sent") when the handler already responded before failing.

Test plan

npx tsc --noEmit and eslint clean on all three touched files (0 errors, 0 warnings). All 24 middleware tests pass, including the pre-existing cacheHeaders suite.

Disclosure

50 of 294 test suites (142 tests) fail on the full server test run on a clean checkout of this branch, unrelated to this change. Confirmed my new test files are not among them.

[vercel]

@Ejere is attempting to deploy a commit to the Edeh Victor's projects Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

Good job.