Rewrite every log call as an event name with typed fields

Prose f-strings become past-tense events with consistent field names
across services (account_id, transaction_id, amount_minor, risk_score,
status_code, consumer_group, message_id, chaos_flag). The orchestrator
and both consumers move from logging.getLogger to structlog so they can
pass fields.

New events cover what was silent before: the gateway's UpstreamFailure
path (transaction_failed, with the underlying cause), fraud's score and
sanctions' screening outcomes, and each successfully processed stream
message. holder_name is no longer logged at all.

"lookup" and "healthz" still appear in exactly one event each, so the
pathology tests' log-line counts are unchanged until they move to LogQL.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

services/sanctions/app.py

@@ -40,7 +40,7 @@ async def root():
 @app.get("/healthz")
 async def healthz(request: Request):
     if request.headers.get("X-Ledgerline-Probe") == "chatty-health":
-        logger.info(f"received chatty-health healthz probe from gateway")
+        logger.info("healthz_probe_received", probe="chatty-health")
     return {"status": "ok", "service": SERVICE_NAME}
 
 
@@ -53,22 +53,23 @@ async def readyz():
         span = trace.get_current_span()
         span.record_exception(exc)
         span.set_status(StatusCode.ERROR, str(exc))
-        logger.exception(f"readyz check failed: {exc}")
+        logger.exception("readyz_check_failed")
         return JSONResponse(status_code=503, content={"status": "unavailable"})
     return {"status": "ok"}
 
 
 @app.post("/internal/lookup")
 async def lookup(body: LookupRequest):
-    logger.info(f"lookup for holder_name={body.holder_name!r}")
+    # holder_name is PII: logged by omission, not by redaction.
+    logger.info("lookup_received")
 
     if await chaos.sanctions_errors_enabled() and chaos.should_error():
-        logger.info("sanctions_errors chaos triggered")
+        logger.info("chaos_engaged", chaos_flag="sanctions_errors")
         return JSONResponse(status_code=503, content={"error": "sanctions vendor unavailable"})
 
     if await chaos.slow_sanctions_enabled():
         delay = chaos.sample_delay_seconds()
-        logger.info(f"slow_sanctions chaos sleeping {delay:.3f}s")
+        logger.info("chaos_engaged", chaos_flag="slow_sanctions", delay_ms=round(delay * 1000, 1))
         await asyncio.sleep(delay)
 
     # holder_name is PII: it stays off the span; only the outcome is recorded.
@@ -77,6 +78,11 @@ async def lookup(body: LookupRequest):
         span.set_attribute("ledgerline.sanctions.matched", match is not None)
         if match:
             span.set_attribute("ledgerline.sanctions.list_source", match["list_source"])
+    logger.info(
+        "holder_screened",
+        matched=match is not None,
+        list_source=match["list_source"] if match else None,
+    )
     if match:
         return {"matched": True, **match}
     return {"matched": False, "country": None, "list_source": None}