refactor: replace console calls with structured logger

[OLAMIGHTY010]

Closes #1348. Replaced console.* calls with logger calls carrying context objects. Enabled the no-console ESLint rule for src/ (excluding scripts/, logger.ts, and tests). Ensured log entries will now include requestId where available via the logger.

[drips-wave]

@OLAMIGHTY010 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[greatest0fallt1me]

Thanks for the contribution! We reviewed this PR while merging the open queue and couldn't merge it yet. Here's what needs fixing:

• Some imports end up inside a comment and inside another import's braces.
• logger is used without being imported.
• It would break existing tests that assert on console output.

Once these are fixed, push to this branch and we'll take another look.

[OLAMIGHTY010]

Thanks for the review! I've gone ahead and pushed fixes for all the issues you pointed out:

Malformed imports: Fixed the syntax error in src/middleware/envelopeValidator.ts where an import was accidentally placed inside a comment/braces.
Missing logger import: Added the missing import { logger } from './logger.js' statement to src/app.ts.
Failing tests: Updated the test suites (ipAllowlist.integration.test.ts and security-headers.test.ts) to spy on the structured logger instead of the native console object, which fixes the assertions without breaking the new logging behavior.

[OLAMIGHTY010]

All review issues have been addressed — malformed imports fixed, logger properly imported, and tests updated to assert on structured logger output rather than console calls. Kindly approve the workflow run so CI can verify. 🙏