FDN-02/FDN-03/FDN-07/FDN-08: Migrations-Rollback, Objekt-Storage-Interface, go.sum-Fix, Observability

- FDN-02: Rollback-fähige Down-Migrationen (024-026), archivdms seed dev CLI
- FDN-03: internal/objectstore Interface + lokaler WORM-Treiber, signierte Download-URLs
- FDN-07: go.mod/go.sum vervollständigt (fehlender go-ldap/v3-Eintrag), CI-Pipeline (.gitea/workflows/ci.yml, bereits in FDN-01 committet) damit lauffähig
- FDN-08: Request-ID-Middleware, /metrics-Endpoint, Panic-Recovery, Login/Logout/Me technisches Logging inkl. Access-Log je Anfrage

internal/api/document_export_handlers.go

@@ -143,7 +143,7 @@ func (s *Server) handleExportDocument(w http.ResponseWriter, r *http.Request) {
 
 	f, err := os.Open(doc.StoragePath)
 	if err != nil {
-		s.logger.Error("export: document file open failed", "document_id", doc.ID, "tenant_id", *sess.TenantID, "err", err)
+		s.reqLog(r.Context()).Error("export: document file open failed", "document_id", doc.ID, "tenant_id", *sess.TenantID, "err", err)
 		fail(http.StatusInternalServerError, "file unavailable", "file_open_failed: "+err.Error())
 		return
 	}
@@ -212,7 +212,7 @@ func (s *Server) handleExportDocument(w http.ResponseWriter, r *http.Request) {
 
 	if streamErr != nil {
 		// Headers are already out — log + audit the partial export, no HTTP error.
-		s.logger.Warn("document export stream failed", "document_id", doc.ID, "err", streamErr)
+		s.reqLog(r.Context()).Warn("document export stream failed", "document_id", doc.ID, "err", streamErr)
 		s.audlog.Log(audit.Entry{
 			EventType: audit.EventDocumentExport, Username: sess.Username, TenantID: sess.TenantID,
 			DocumentID: idStr, Success: false, Detail: "stream_failed: " + streamErr.Error(),