feat(sdk): emit one access line per request from requestLogMiddleware

[I-am-nothing]

Problem

The module log pipeline (SDK structured logging → dev shipper → dispatch ring → platform Logcat) is fully wired, but a module's Logcat stays empty unless the module explicitly calls ms.Log(ctx). requestLogMiddleware only attaches a pre-tagged per-request logger to the context — it never emits a line itself. oauth-core (and any module without hand-rolled logging) therefore produces nothing, so the Logcat shows nothing even after real traffic.

Fix

Emit one structured access line per request from requestLogMiddleware, using the per-request logger it already builds (so the line carries module_id / request_id / app_id / user_id / app_role):

{"level":"INFO","msg":"request","method":"GET","path":"/public/start","status":403,"duration_ms":2, ...}

Now every module's traffic appears in the Logcat out of the box, no per-module logging code required.

• Path only, never the query string — state/code/tokens ride the query in OAuth flows and must never land in logs.
• statusRecorder captures the status (defaults to 200, matching net/http) and forwards Flush so wrapping never silently disables an SSE handler.
• app_id is the trusted auth.Get value, never a request field.

Verification

• go test ./internal/core/ ✓ (new TestRequestLogMiddleware_EmitsAccessLine asserts the line emits with the handler's status and that state=secret is not leaked)

Rollout

Local dev resolves the SDK via the replace directive, so merging + pulling the SDK checkout + a runner recreate is enough for oauth-core to start emitting. Published consumers pinned to a version tag would pick this up on the next SDK release.

🤖 Generated with Claude Code