fix(#12): Implement structured logging with request correlation and security event marking

backend/middleware/logger.js

@@ -0,0 +1,51 @@
+const { format, createLogger, transports } = require('winston');
+
+const logger = createLogger({
+  format: format.combine(
+    format.timestamp(),
+    format.json()
+  ),
+  transports: [
+    new transports.Console()
+  ]
+});
+
+// Middleware to generate a unique request ID
+const requestId = (req, res, next) => {
+  req.id = `${Date.now()}-${Math.random().toString(36).substr(2, 9)}`;
+  next();
+};
+
+// Middleware to log requests
+const requestLogger = (req, res, next) => {
+  logger.info({
+    timestamp: new Date().toISOString(),
+    method: req.method,
+    url: req.url,
+    requestId: req.id
+  });
+  next();
+};
+
+// Middleware to log errors
+const errorLogger = (err, req, res, next) => {
+  const isSecurityEvent = err.message.includes('Authentication') || 
+                         err.message.includes('Authorization') ||
+                         err.message.includes('Security');
+  const level = isSecurityEvent ? 'security' : 'error';
+  
+  logger[level]({
+    timestamp: new Date().toISOString(),
+    error: err.message,
+    stack: err.stack,
+    requestId: req.id,
+    route: req.route ? req.route.path : req.path
+  });
+  next(err);
+};
+
+module.exports = {
+  requestId,
+  requestLogger,
+  errorLogger
+};