Propagate request IDs through middleware logs

[kebanks2]

Summary

• fixes [ Bounty $9k ] [ Middleware ] Enforce same request ID on background task logs — observability #3601 by adding an outer ASGI request ID middleware that sanitizes or generates X-Request-ID, adds it to every HTTP response, and keeps the context active until background tasks complete
• injects the active request ID into log records through a request-ID log filter so background-task logs use the same ID as request logs
• covers successful requests, auth-rejected requests, and unhandled exception paths without leaking raw invalid request IDs or exception text
• includes current-main test-health fixes needed for API/full-suite validation: export AgentStatus from src.agent and make the metrics timer lock re-entrant

Validation

• python -m flake8 src/api/middleware.py src/api/server.py tests/test_request_id_middleware.py src/agent/__init__.py src/common/metrics.py
• python -m pytest -q -> 25 passed
• python -m py_compile src/api/middleware.py src/api/server.py tests/test_request_id_middleware.py src/agent/__init__.py src/common/metrics.py
• git diff --check
• star gate verified: gh repo view orchestration-agent/AgentOrchestration --json viewerHasStarred --jq '.viewerHasStarred' -> true

No secrets, tokens, hidden context, private runtime data, or payout details are included.