feat(pipeline): wire 7 backend modules into request pipeline

Batch 1 — Pipeline Wiring:
- server-init.js: initialize compliance audit_log, run expired log cleanup, log server.start
- chat.js: wire circuitBreaker (provider resilience), modelAvailability (TTL cooldowns),
  requestTelemetry (7-phase lifecycle), requestId, costRules (budget check/record),
  compliance audit logging. All wiring is non-breaking with try/catch guards.
- proxy.js: replace bare fetch() with fetchWithTimeout (5s timeout on /api/settings),
  add X-Request-Id header for end-to-end tracing
- 307/307 tests pass, build succeeds

src/proxy.js

@@ -1,5 +1,7 @@
 import { NextResponse } from "next/server";
 import { jwtVerify } from "jose";
+import { fetchWithTimeout } from "./shared/utils/fetchTimeout.js";
+import { generateRequestId } from "./shared/utils/requestId.js";
 
 // FASE-01: Fail-fast — no hardcoded fallback. Server must have JWT_SECRET configured.
 if (!process.env.JWT_SECRET) {
@@ -11,11 +13,16 @@ const SECRET = new TextEncoder().encode(process.env.JWT_SECRET);
 export async function proxy(request) {
   const { pathname } = request.nextUrl;
 
+  // Pipeline: Add request ID header for end-to-end tracing
+  const requestId = generateRequestId();
+  const response = NextResponse.next();
+  response.headers.set("X-Request-Id", requestId);
+
   // Protect all dashboard routes (except onboarding)
   if (pathname.startsWith("/dashboard")) {
     // Always allow onboarding — it has its own setupComplete guard
     if (pathname.startsWith("/dashboard/onboarding")) {
-      return NextResponse.next();
+      return response;
     }
 
     const token = request.cookies.get("auth_token")?.value;
@@ -23,12 +30,13 @@ export async function proxy(request) {
     if (token) {
       try {
         await jwtVerify(token, SECRET);
-        return NextResponse.next();
+        return response;
       } catch (err) {
         // FASE-01: Log auth errors instead of silently redirecting
         console.error("[Middleware] auth_error: JWT verification failed:", err.message, {
           path: pathname,
           tokenPresent: true,
+          requestId,
         });
         return NextResponse.redirect(new URL("/login", request.url));
       }
@@ -36,22 +44,24 @@ export async function proxy(request) {
 
     const origin = request.nextUrl.origin;
     try {
-      const res = await fetch(`${origin}/api/settings`);
+      // Pipeline: Use fetchWithTimeout instead of bare fetch
+      const res = await fetchWithTimeout(`${origin}/api/settings`, { timeoutMs: 5000 });
       const data = await res.json();
       // Skip auth if login is not required
       if (data.requireLogin === false) {
-        return NextResponse.next();
+        return response;
       }
       // Skip auth if no password has been set yet (fresh install)
       // This prevents an unresolvable loop where requireLogin=true but no password exists
       if (!data.hasPassword) {
-        return NextResponse.next();
+        return response;
       }
     } catch (err) {
       // FASE-01: Log settings fetch errors instead of silencing them
       console.error("[Middleware] settings_error: Settings fetch failed:", err.message, {
         path: pathname,
         origin,
+        requestId,
       });
       // On error, require login
     }
@@ -63,9 +73,10 @@ export async function proxy(request) {
     return NextResponse.redirect(new URL("/dashboard", request.url));
   }
 
-  return NextResponse.next();
+  return response;
 }
 
 export const config = {
   matcher: ["/", "/dashboard/:path*"],
 };
+