FDN-02/FDN-03/FDN-07/FDN-08: Migrations-Rollback, Objekt-Storage-Interface, go.sum-Fix, Observability

- FDN-02: Rollback-fähige Down-Migrationen (024-026), archivdms seed dev CLI
- FDN-03: internal/objectstore Interface + lokaler WORM-Treiber, signierte Download-URLs
- FDN-07: go.mod/go.sum vervollständigt (fehlender go-ldap/v3-Eintrag), CI-Pipeline (.gitea/workflows/ci.yml, bereits in FDN-01 committet) damit lauffähig
- FDN-08: Request-ID-Middleware, /metrics-Endpoint, Panic-Recovery, Login/Logout/Me technisches Logging inkl. Access-Log je Anfrage

internal/api/document_bulk_export_handlers.go

@@ -197,7 +197,7 @@ func (s *Server) handleBulkExportDocuments(w http.ResponseWriter, r *http.Reques
 		if err != nil {
 			// A single unreadable document must not kill the archive — unless the
 			// ZIP writer itself failed, which we detect on Close below.
-			s.logger.Warn("bulk export: document skipped", "document_id", doc.ID, "tenant_id", tenantID, "err", err)
+			s.reqLog(r.Context()).Warn("bulk export: document skipped", "document_id", doc.ID, "tenant_id", tenantID, "err", err)
 			skipped = append(skipped, fmt.Sprintf("%d: %v", doc.ID, err))
 			continue
 		}
@@ -225,7 +225,7 @@ func (s *Server) handleBulkExportDocuments(w http.ResponseWriter, r *http.Reques
 	detail := fmt.Sprintf("zip_bulk_export: exported=%d skipped=%d", exported, len(skipped))
 	if streamErr != nil {
 		// Headers are already out — audit the partial export, no HTTP error.
-		s.logger.Warn("bulk document export stream failed", "tenant_id", tenantID, "err", streamErr)
+		s.reqLog(r.Context()).Warn("bulk document export stream failed", "tenant_id", tenantID, "err", streamErr)
 		s.audlog.Log(audit.Entry{
 			EventType: audit.EventDocumentBulkExport, Username: sess.Username, TenantID: sess.TenantID,
 			Success: false, Detail: detail + " stream_failed: " + streamErr.Error(),