[albanm]

One logger for the whole stack in @data-fair/lib-node/log.js, replacing eventsLog, internalError and ad-hoc console output:

• log.info|warn|alert|error(msg, { code?, err?, ... }): JSON lines on stdout when NODE_ENV=production, pretty otherwise (LOG_FORMAT overrides); alert is a custom level for events that deserve the scrutiny of errors
• errors serialized with a whitelist (no headers, request config or document content), messages truncated to 1000 chars
• warn/alert/error lines counted in df_logs{level, code, host}; df_internal_error and df_events_log still emitted, deprecated
• implicit context with withLogContext / getLogContext (also for worker threads); session.middleware() opens it per request with ip, host, user and account
• debug stays the debug API, its output is redirected into the logger
• trace ids come from the OpenTelemetry operator's pino instrumentation, no OTel code in the lib
• reqIp in optional mode flags a non-IP X-Forwarded-For and returns undefined instead of throwing

Why: uniform, structured output for everything (audit events, errors, debug) so logs can be filtered by host, account, level and code in Loki/VictoriaLogs and grouped by trace id, with minimal setup and no logger instances passed around.

Heads-up:

• breaking: eventsLog, internalError and EVENTS_LOG_LEVEL removed; release lib-node as a major first, then bump lib-express's peer range to ^3.0.0 (and its README) before releasing it as a major
• output format changes (no df-event: prefix, JSON on stdout): fluent-bit routes must be adapted before services upgrade
• session.middleware() now passes session loading failures to next(err) instead of rejecting
• info lines no longer increment df_events_log