feat: implement rate limiting, structured logging, webhook verification, and migration runner

[bitcoindev817-hue]

Closes #65
Closes #66
Closes #67
Closes #68

Changes Summary

#65 - Rate Limiting with Redis-backed Sliding Window Counter

• Replaced simple counter-based rate limiting with a sliding window approach using Redis sorted sets (ZADD/ZREMRANGEBYSCORE/ZCARD) with timestamps as scores
• Added in-memory fallback when Redis is unavailable instead of failing closed with 503
• Updated internal/infrastructure/ratelimit/redis.go with sliding window implementation and InMemoryRateLimiter
• Updated internal/api/middleware/ratelimit.go to use the new sliding window and in-memory fallback
• Updated internal/api/middleware/rate_limit_test.go to reflect new fallback behavior

#66 - Structured Logging with Correlation IDs

• Added logger.Ctx(ctx) utility in pkg/logger/logger.go for request-scoped loggers with correlation ID and userID
• Enhanced internal/api/middleware/logging.go to include callerIdentity (userID) in request completion logs
• Replaced ad hoc fmt.Printf in internal/domain/email/service.go with structured zerolog calls
• Propagated X-Request-ID header to outbound HTTP calls in webhook dispatcher, Yellow Card client, and Brevo email service
• Added GetUserIDFromGin() helper for reading userID from Gin context after authentication

#67 - Webhook Signature Verification with Constant-Time Comparison

• Added SignWebhookPayload() and VerifyWebhookSignature() functions in webhook/service.go using HMAC-SHA256
• Uses crypto/subtle.ConstantTimeCompare for timing-safe comparison to prevent timing attacks
• Added POST /webhooks/incoming/:id endpoint for receiving incoming webhooks with signature verification
• Added GetByID() method to WebhookRepository interface and PostgresRepository
• Added IncomingWebhookHandler in internal/api/handler/webhook_handler.go
• Added comprehensive tests in webhook/service_test.go covering valid, tampered, and missing signatures

#68 - Database Migration Runner with Rollback Support

• Migration runner already exists and is complete in cmd/migrate/main.go
• Tracks applied migrations in schema_migrations table
• Supports up/down migrations with automatic transaction rollback on failure
• Integrates with PostgreSQL with advisory locking for concurrent safety
• Verified complete with existing tests in cmd/migrate/main_test.go

[drips-wave]

@bitcoindev817-hue Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits