Add structured logging + request IDs + audit log hooks.

[bishopZ]

The auth migration checklist already calls out audit logging; formalizing it as a default pattern would improve debuggability and security posture early.

AUTHENTICATION.md:105-111