feat(06-02): wire CorrelationIDMiddleware + config fields + promote 5 test stubs

- backend/config.py: add log_level: str = "INFO" and log_json: bool = False
  fields under Observability (Phase 6 — D-01) comment; pydantic-settings reads
  LOG_LEVEL / LOG_JSON env vars automatically
- backend/main.py: add imports (uuid, time, structlog, ASGIApp/Receive/Scope/Send,
  setup_logging); add CorrelationIDMiddleware raw-ASGI class (NOT BaseHTTPMiddleware
  — avoids streaming buffering); call setup_logging() as first lifespan statement;
  register CorrelationIDMiddleware LAST so it runs FIRST (Starlette reverse order)
- backend/tests/test_logging.py: remove all 5 xfail decorators; replace single-line
  bodies with real assertions for JSON renderer, contextvar binding, X-Correlation-ID
  header, no-bleed between requests, uvicorn.access propagate=False

backend/config.py

@@ -70,5 +70,9 @@ class Settings(BaseSettings):
     # used to construct OAuth success/error redirect to Vue app (per Phase 5 B4 fix)
     # Note: frontend_url already declared above for Phase 2 (password reset links) — shared field
 
+    # Observability (Phase 6 — D-01)
+    log_level: str = "INFO"
+    log_json: bool = False
+
 
 settings = Settings()