重构日志与可观测性体系

新增单行文本编码器与结构化 GORM 日志，统一错误记录与请求日志策略，收紧日志文件权限并修复按天切分与压缩，支付回调参数脱敏，生产强制阿里云短信，RequestID 校验防注入，日志文案中文化。

backend/internal/middleware/request_logger_integration_test.go

@@ -0,0 +1,52 @@
+package middleware
+
+import (
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"hfb_sys/backend/pkg/response"
+
+	"github.com/gin-gonic/gin"
+	"go.uber.org/zap"
+	"go.uber.org/zap/zaptest/observer"
+)
+
+func TestRequestLoggerRecordsServerErrorCause(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	core, observed := observer.New(zap.DebugLevel)
+	engine := gin.New()
+	engine.Use(RequestID(), RequestLogger(zap.New(core)))
+	engine.GET("/failed", func(c *gin.Context) {
+		response.RecordError(c, errors.New("database unavailable"))
+		response.Error(c, http.StatusInternalServerError, "internal_error", "服务暂时不可用")
+	})
+
+	request := httptest.NewRequest(http.MethodGet, "/failed", nil)
+	responseRecorder := httptest.NewRecorder()
+	engine.ServeHTTP(responseRecorder, request)
+
+	entries := observed.FilterMessage("HTTP 请求失败").All()
+	if len(entries) != 1 {
+		t.Fatalf("server error logs = %d, want 1", len(entries))
+	}
+	fields := entries[0].ContextMap()
+	if fields["error"] != "database unavailable" || fields["code"] != "internal_error" {
+		t.Fatalf("unexpected fields: %v", fields)
+	}
+}
+
+func TestRequestLoggerSkipsOrdinaryNotFound(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	core, observed := observer.New(zap.DebugLevel)
+	engine := gin.New()
+	engine.Use(RequestID(), RequestLogger(zap.New(core)))
+
+	request := httptest.NewRequest(http.MethodGet, "/missing", nil)
+	responseRecorder := httptest.NewRecorder()
+	engine.ServeHTTP(responseRecorder, request)
+	if observed.Len() != 0 {
+		t.Fatalf("ordinary 404 should not produce logs: %v", observed.All())
+	}
+}