feat: shared Express request-log middleware

[vreshch]

Ports web's packages/backend/src/middleware/request-log.ts into the kit so memory-mcp and agentage-auth emit the same one-line-per-request wide event: kind:'http', method, path, route, status, duration_ms, user_id (+ trace_id/span_id from the logger mixin).

• createRequestLog(log, options?) - factory, register before the routers so 404s and rate-limited requests are counted; logs on finish.
• Regex-mount fallback: when req.route is missing OR Express matched by RegExp (auth mounts Better Auth behind one pattern, so route.path is the regex SOURCE), the route falls back to routeFromUrl(req.path). readableRoute rewrites regex sources and only those, so a rewrite is the detector - no duplicated logic.
• classify injection point supplies user_type; the field is omitted when no classifier is passed, keeping @agentage/shared out of this package. userId overrides the req.user.id default.
• Express stays out of the dependency list: structural request/response types, matching error-emitters.ts.
• No version bump; release goes through the normal flow after merge.