[johnnyhuy]

Finalise the preserved structured logging work against current main. PR #11 already landed the formatter, redaction, request correlation and settings; this change reconciles the abandoned patch with those controls.

• Add app.logging as the settings-based setup entrypoint, reusing the existing JSON formatter.
• Configure logging before application singleton imports in the API and bot processes. Importing slack_bot no longer changes the API's service label.
• Expand the schema example, application conventions, destinations, retention assumptions and assessment gaps in docs/logging.md.
• Add subprocess checks for actual JSON/text stdout, levels, redaction, service metadata, duplicate handlers and an offline API health request. Include logging checks in mise run test-backend and CI.

Validation: mise run test-backend passes all 23 tests, including the offline /health request emitting exactly one JSON wide event. The focused run also passed all 20 streaming tests. Full-suite collection remains blocked in test_api.py and test_file_upload.py by Slack auth.test without valid credentials, as recorded in #11; this PR's health check mocks Slack authentication and RAG initialization.

Refs #7 (already closed by #11).

Parent deliverable: Wingman#7 structured logging baseline (6h9PGXJWhfcvrfGH).

Self-review: issue #7 coverage is complete; test type hints/docstrings were corrected to match CONTRIBUTING.md. The first CI run passed tests and security checks, then exposed an existing image tag bug on pull requests ({{branch}} expands empty). Use the stable sha- prefix so both container build checks can run.

Final verification: all PR checks passed, including both container builds, the expanded backend test task, CodeQL and Socket Security. Independent Standards and Spec reviews have no remaining findings.