Task/audit otel

[annacodervibe]

Before implementing, I checked the codebase and found there was no existing OTel infrastructure at all - no packages installed, no tracer setup, nothing. What did already exist and is reused here: the correlation ID system (res.locals.correlationId / getRequestId()), and the standardized error envelope pattern. Rather than inventing new versions of either, this reuses both.

There are actually 4 audit handlers, not the one the issue's file paths suggested:

GET /api/markets/:id/audit (marketAudit.ts)
GET /api/admin/audit (admin/audit.ts)
POST /api/admin/audit/search (admin/audit/search.ts)
GET /api/admin/audit/export (admin/audit/export.ts)

All 4 are instrumented.

What's new:

src/otel/tracer.ts sets up a minimal tracer using @opentelemetry/api and @opentelemetry/sdk-trace-base, exporting spans to console/stdout for now. Wiring up a real OTLP exporter to an actual tracing backend (Jaeger, Honeycomb, etc.) is a natural follow-up, not something this PR does.

src/otel/spans.ts provides startAuditSpan, endAuditSpan, and recordErrorOnSpan helpers, with correlation ID and method/path attributes set automatically.

Each of the 4 handlers now starts a span, sets relevant attributes (including things like market ID where relevant), records exceptions on failure, and ends the span with the right status code.

The export endpoint is a stream, so its span doesn't end when the handler function returns, it ends when the response stream actually finishes (covering natural completion, client disconnect, and stream errors), so span duration reflects the real export time.

Tests: 11 new tests covering span creation, attribute population, correlation ID fallback behavior, and error recording.

A note on pre-existing issues: this repo's tsc --noEmit / npm run build currently reports 119 pre-existing TypeScript errors across 20 files, completely unrelated to this change (missing exports, duplicate imports in index.ts, drizzle-orm type mismatches, etc.). I verified this by running the exact same build on main before my changes, byte-for-byte identical error count and file list. Not something I've touched or attempted to fix here, since it's out of scope for #386.

Closes #386

[drips-wave]

@annacodervibe Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits