Add bounded sampling for high-volume API logs

[Johnpii1]

Description

This PR introduces deterministic API log sampling to reduce routine success-log volume while ensuring that security-related events and unexpected errors are always recorded. Logging decisions are made predictably using the request ID and route, while aggregate metrics continue to capture all requests regardless of sampling.

Changes Made

• Added deterministic log sampling based on request ID and route.
• Introduced configurable sampling for routine successful requests to reduce log noise.
• Ensured unexpected errors and denied security actions are always logged and never sampled out.
• Preserved aggregate metrics so all requests are counted regardless of whether a log entry is emitted.
• Added logging utilities in src/server/api/logging.ts to centralize and standardize sampling behavior.
• Added unit tests to verify deterministic sampling behavior and ensure critical logs are never omitted.

Testing

• ✅ Ran targeted unit tests:
  • tests/unit/api/logging.test.ts
• ✅ Ran the full unit test suite — 756 tests passed.
• ✅ npm run lint completed successfully.
• ✅ npm run build completed successfully.

closes #1519