Rewrite every log call as an event name with typed fields

Prose f-strings become past-tense events with consistent field names
across services (account_id, transaction_id, amount_minor, risk_score,
status_code, consumer_group, message_id, chaos_flag). The orchestrator
and both consumers move from logging.getLogger to structlog so they can
pass fields.

New events cover what was silent before: the gateway's UpstreamFailure
path (transaction_failed, with the underlying cause), fraud's score and
sanctions' screening outcomes, and each successfully processed stream
message. holder_name is no longer logged at all.

"lookup" and "healthz" still appear in exactly one event each, so the
pathology tests' log-line counts are unchanged until they move to LogQL.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

services/audit/consumer.py

@@ -1,8 +1,8 @@
 import asyncio
 import json
-import logging
 
 import sqlalchemy as sa
+import structlog
 from opentelemetry import propagate, trace
 from opentelemetry.instrumentation.utils import suppress_instrumentation
 from opentelemetry.trace import SpanKind, StatusCode
@@ -11,7 +11,7 @@ from common.db import Session
 from common.redis_client import redis_client
 from common.settings import settings
 
-logger = logging.getLogger("audit")
+logger = structlog.get_logger("audit")
 tracer = trace.get_tracer(__name__)
 
 GROUP = "audit"
@@ -46,7 +46,7 @@ async def run():
     proves the async fork fans out to genuinely separate consumers, not one
     consumer doing both jobs."""
     await ensure_group()
-    logger.info("audit consumer started")
+    logger.info("consumer_started", consumer_group=GROUP)
     while True:
         try:
             # The blocking poll would otherwise be a ~2s root trace every loop.
@@ -61,7 +61,7 @@ async def run():
         except asyncio.CancelledError:
             raise
         except Exception:
-            logger.exception("audit consumer read failed")
+            logger.exception("stream_read_failed", consumer_group=GROUP)
             await asyncio.sleep(1)
             continue
 
@@ -85,8 +85,19 @@ async def run():
                 ) as span:
                     try:
                         await _handle(fields)
+                        logger.info(
+                            "stream_message_processed",
+                            consumer_group=GROUP,
+                            message_id=msg_id,
+                            transaction_id=fields.get("transaction_id"),
+                        )
                     except Exception as exc:
                         span.record_exception(exc)
                         span.set_status(StatusCode.ERROR, str(exc))
-                        logger.exception(f"audit failed to process message {msg_id}")
+                        logger.exception(
+                            "stream_message_failed",
+                            consumer_group=GROUP,
+                            message_id=msg_id,
+                            transaction_id=fields.get("transaction_id"),
+                        )
                     await redis_client.xack(settings.stream_name, GROUP, msg_id)