feat(web): stamp x-request-id header on every response

[iscekic]

Request

In the backend, ensure every HTTP response carries an x-request-id header: reuse the incoming x-request-id when the client sends one, otherwise generate a UUID. Add a unit test that asserts both cases.

Changelog for users

• Every backend HTTP response now includes an x-request-id header.
• When the client sends an x-request-id, the response echoes it back unchanged.
• When the client omits x-request-id, the backend generates a new UUID v4 for that response.

Changelog for maintainers

• Added a withRequestId middleware exporting REQUEST_ID_HEADER (x-request-id); it wraps the proxy chain outermost, so it stamps responses produced by downstream wrappers as well, including early returns such as blocked clients (426) and 404s.
• The middleware reuses the incoming x-request-id when present, otherwise generates one via crypto.randomUUID().
• Unit tests assert the reuse case, the generation case, per-response distinctness, and stamping of early-return responses.
• Review hint: confirm the wrapping order in apps/web/src/proxy.ts keeps withRequestId outermost so no early-return path bypasses the header.

E2E proof

Follow-ups (not changed here)

• sign-in — left panel is empty black in headless capture (e1-sign-in.png).