tiennm99 6368bc80ce feat(log): structured slog.JSONHandler + 22-site rewire ...

Phase 4 of the 2026-05-09 review remediation plan.

- internal/log: thin facade over log/slog.NewJSONHandler writing to
  stdout. Cloud Run's Cloud Logging integration auto-parses level,
  time, msg fields. Honours LOG_LEVEL env (debug|info|warn|error).
  Re-exports Info/Warn/Error/Fatal/Debug/With ergonomics.
- Migrated all 22 stdlib log call sites: cmd/server/main.go (17),
  internal/server/router.go (2), internal/modules/dispatcher.go (1),
  internal/telegram/webhook.go (1), internal/modules/misc/misc.go (1).
  Format-string args replaced with structured key/value attrs.
- Closes log-injection class (J3 from security audit) — slog escapes
  newlines and quotes inside field values, so attacker-controlled
  strings cannot synthesise fake log records (test:
  TestNewlineEscaping_NoLogInjection).

go test -race -count=1 ./... clean across all 13 packages. Zero
stdlib log imports remain outside internal/log.

2026-05-09 16:01:00 +07:00

..

health.go

feat(server,modules): bootstrap server and module framework

2026-05-08 23:27:12 +07:00

router_test.go

feat(storage): Firestore KVStore + KVProvider abstraction

2026-05-08 23:51:24 +07:00

router.go

feat(log): structured slog.JSONHandler + 22-site rewire

2026-05-09 16:01:00 +07:00

timeouts.go

feat(server): high-priority hardening + critical blockers

2026-05-09 15:52:15 +07:00