Add structured logging and centralized error handling

- Initialize slog in the serve command with terminal/file support
- Introduce `AppError` with HTTP status for unified service-layer errors
- Replace ad-hoc `api.Error` calls with `api.RespondError`
- Wrap internal errors with `model.NewInternalError` and add reference
  IDs
- Add `RequestID` middleware and switch router from `gin.Default` to
  `gin.New`

internal/service/auth_test.go

@@ -2,6 +2,8 @@ package service
 
 import (
 	"context"
+	"errors"
+	"net/http"
 	"testing"
 	"time"
 
@@ -336,8 +338,9 @@ func TestAuthService_RevokePasskeyNotOwner(t *testing.T) {
 	claimsBob, _ := auth.ParseToken(pairBob.AccessToken, []byte("test-secret"))
 
 	err = svc.RevokePasskey(ctx, claimsBob.UserID, pk.ID)
-	if err != model.ErrForbidden {
-		t.Fatalf("expected ErrForbidden, got %v", err)
+	var ae *model.AppError
+	if !errors.As(err, &ae) || ae.Status != http.StatusForbidden {
+		t.Fatalf("expected AppError 403 Forbidden, got %v", err)
 	}
 }