Replace X-Request-Id with the trace ID and retire the guard suite

Step 6: downstream_client() no longer sends X-Request-Id, and request_id
is gone from the internal request bodies, models, function signatures
and log lines; correlation now travels as traceparent. The gateway's
public request_id stays (the contract tests require it) but is now the
trace ID, 32 hex digits and still a valid UUID, so the value the
frontend shows can be pasted into Tempo.

Step 7: delete tests/test_no_observability.py. It guarded the Phase 0
"no observability" state, which Phase 3 ends by design.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

common/http.py

@@ -3,11 +3,8 @@ import httpx
 from .settings import settings
 
 
-def downstream_client(request_id: str) -> httpx.AsyncClient:
-    """An httpx.AsyncClient preconfigured with the 3s downstream timeout and
-    the X-Request-Id header forwarded, per phase-0-base-project-spec.md §9 --
-    this header is the only correlation mechanism that exists in Phase 0."""
-    return httpx.AsyncClient(
-        timeout=settings.downstream_timeout_seconds,
-        headers={"X-Request-Id": request_id},
-    )
+def downstream_client() -> httpx.AsyncClient:
+    """An httpx.AsyncClient preconfigured with the 3s downstream timeout.
+    Correlation travels as W3C `traceparent`, injected by the httpx
+    instrumentation (common/telemetry.py) -- it replaced Phase 0's X-Request-Id."""
+    return httpx.AsyncClient(timeout=settings.downstream_timeout_seconds)