Log identity_id on every authenticated request

Add a single info log line in each authn middleware once an identity is
resolved, so every authenticated request emits a record that ties the
request back to its user and credential:

- Cookie session middleware logs "session authenticated" with
  identity_id and session_id.
- API key middleware logs "api key authenticated" with identity_id and
  api_key_id.
- OAuth2 access token middleware logs "access token authenticated"
  with identity_id and access_token_id.

The credential IDs are row identifiers (GIDs), not the secret token
values, so they're safe to log and let operators correlate a request
back to the specific credential used. The log lines use the
request-scoped logger from httpserver.LoggerFromContext so they
inherit http_request_id and any other middleware-attached attributes.

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

pkg/server/api/authn/api_key_middleware.go

@@ -22,6 +22,7 @@ import (
 	"github.com/99designs/gqlgen/graphql"
 	"github.com/vektah/gqlparser/v2/gqlerror"
 	"go.gearno.de/kit/httpserver"
+	"go.gearno.de/kit/log"
 	"go.probo.inc/probo/pkg/gid"
 	"go.probo.inc/probo/pkg/iam"
 	"go.probo.inc/probo/pkg/securetoken"
@@ -87,6 +88,13 @@ func NewAPIKeyMiddleware(svc *iam.Service, tokenSecret string) func(next http.Ha
 				ctx = ContextWithAPIKey(ctx, apiKey)
 				ctx = ContextWithIdentity(ctx, identity)
 
+				httpserver.LoggerFromContext(ctx).InfoCtx(
+					ctx,
+					"api key authenticated",
+					log.String("identity_id", identity.ID.String()),
+					log.String("api_key_id", apiKey.ID.String()),
+				)
+
 				next.ServeHTTP(w, r.WithContext(ctx))
 			},
 		)

pkg/server/api/authn/oauth2_access_token_middleware.go

@@ -18,6 +18,8 @@ import (
 	"fmt"
 	"net/http"
 
+	"go.gearno.de/kit/httpserver"
+	"go.gearno.de/kit/log"
 	"go.probo.inc/probo/pkg/bearertoken"
 	"go.probo.inc/probo/pkg/iam"
 )
@@ -52,6 +54,13 @@ func NewOAuth2AccessTokenMiddleware(svc *iam.Service) func(next http.Handler) ht
 
 				ctx = ContextWithIdentity(ctx, identity)
 
+				httpserver.LoggerFromContext(ctx).InfoCtx(
+					ctx,
+					"access token authenticated",
+					log.String("identity_id", identity.ID.String()),
+					log.String("access_token_id", accessToken.ID.String()),
+				)
+
 				next.ServeHTTP(w, r.WithContext(ctx))
 			},
 		)

pkg/server/api/authn/session_middleware.go

@@ -23,6 +23,7 @@ import (
 	"github.com/99designs/gqlgen/graphql"
 	"github.com/vektah/gqlparser/v2/gqlerror"
 	"go.gearno.de/kit/httpserver"
+	"go.gearno.de/kit/log"
 	"go.probo.inc/probo/pkg/gid"
 	"go.probo.inc/probo/pkg/iam"
 	"go.probo.inc/probo/pkg/securecookie"
@@ -105,6 +106,13 @@ func NewSessionMiddleware(svc *iam.Service, cookieConfig securecookie.Config) fu
 				ctx = ContextWithSession(ctx, session)
 				ctx = ContextWithIdentity(ctx, identity)
 
+				httpserver.LoggerFromContext(ctx).InfoCtx(
+					ctx,
+					"session authenticated",
+					log.String("identity_id", identity.ID.String()),
+					log.String("session_id", session.ID.String()),
+				)
+
 				next.ServeHTTP(w, r.WithContext(ctx))
 
 				err = svc.SessionService.UpdateSessionData(ctx, session.ID, session.Data)