Replace X-Request-Id with the trace ID and retire the guard suite

Step 6: downstream_client() no longer sends X-Request-Id, and request_id
is gone from the internal request bodies, models, function signatures
and log lines; correlation now travels as traceparent. The gateway's
public request_id stays (the contract tests require it) but is now the
trace ID, 32 hex digits and still a valid UUID, so the value the
frontend shows can be pasted into Tempo.

Step 7: delete tests/test_no_observability.py. It guarded the Phase 0
"no observability" state, which Phase 3 ends by design.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

services/gateway/app.py

@@ -7,6 +7,7 @@ from fastapi import FastAPI, Request
 from fastapi.responses import FileResponse, JSONResponse
 from fastapi.staticfiles import StaticFiles
 from pydantic import BaseModel, field_validator
+from opentelemetry import trace
 from opentelemetry.instrumentation.fastapi import FastAPIInstrumentor
 from opentelemetry.instrumentation.utils import suppress_instrumentation
 
@@ -34,9 +35,7 @@ app.mount("/static", StaticFiles(directory=STATIC_DIR), name="static")
 
 # A shared, connection-pooling client for the simple read-only proxy routes
 # below -- opening a fresh httpx.AsyncClient (and TCP connection) per request
-# is real, needless overhead under concurrent load. orchestrator.py's
-# downstream_client() stays per-request since it carries per-transaction
-# headers (X-Request-Id).
+# is real, needless overhead under concurrent load.
 _proxy_client = httpx.AsyncClient(
     timeout=settings.downstream_timeout_seconds,
     limits=httpx.Limits(max_connections=100, max_keepalive_connections=50),
@@ -115,14 +114,22 @@ async def account_insights(account_id: str):
 
 @app.post("/api/transactions", status_code=201)
 async def submit_transaction(body: TransactionRequest):
-    request_id = str(uuid.uuid4())
+    request_id = _request_id()
     try:
-        result = await orchestrator.create_transaction(body.model_dump(), request_id)
+        result = await orchestrator.create_transaction(body.model_dump())
     except UpstreamFailure as exc:
         return JSONResponse(
             status_code=exc.status_code, content={"error": exc.message, "request_id": request_id}
         )
-    return JSONResponse(status_code=201, content=result)
+    return JSONResponse(status_code=201, content={**result, "request_id": request_id})
+
+
+def _request_id() -> str:
+    """The response's `request_id` is the trace ID: paste it into Tempo to get
+    the whole request. 32 hex digits, which is still a valid UUID. Falls back to
+    a random one if no span is recording (telemetry not set up)."""
+    ctx = trace.get_current_span().get_span_context()
+    return format(ctx.trace_id, "032x") if ctx.is_valid else uuid.uuid4().hex
 
 
 @app.get("/api/health/all")