APP-RIP: delete the homegrown correlation_id (cid) from pramaan-app

1 — What was still alive after Story-1454

A grep for correlation across src/ showed cid was not dead — it was still load-bearing:

• outbound-headers.ts — minted and stamped x-pramaan-correlation-id on every outbound backend call (alongside the Bug-1471 traceparent path).
• server-auth.ts — resolved a cid to attach correlation_id to the currentUser failure log.
• app/api/health/route.ts — echoed the cid header on the liveness response.
• proxy-observability.ts / gateway.ts — carried a correlationId log field through the proxy and gateway log lines.
• gen/_assert.ts — a correlation_id on the api_contract_violation log context (no caller ever set it).
• correlation-context.ts — an AsyncLocalStorage cid context whose writer (runWithCorrelationContext) had zero callers — already inert.

2 — Changes

3 — What was deliberately NOT touched

The Bug-1471 connected-graph path

outbound-headers.ts still injects the active @vercel/otel span via the installed W3C propagator (injectActiveTraceContext) so the forwarded traceparent (id A) is the same span exported to X-Ray — the join that makes pramaan-app-api land on the SAME trace. The kill-switch (PRAMAAN_OTEL_DISABLED) strip and the tracestate carry are unchanged. trace_id / span_id and run_id are untouched.

The generated backend contract mirror

src/gen/{zod,types,schemas} still carry HealthResponse.correlation_id. That field mirrors the backend contract (openapi/app-api.json still defines it) and is regenerated by codegen — per HR-22 + openapi/AGENTS.md it must not be hand-edited. Its removal is the separate pramaan-functions cid rip-out child (EPIC-1400 Phase-2), after which a mirror-sync + pnpm codegen drops it from the app. It is the only remaining correlation hit in src/, and it is backend-owned by design.

4 — Verification

# grep-zero cid in app source (only the generated backend mirror remains)
grep -rniE 'correlation' src/ | grep -v 'src/gen/'   # -> ZERO
grep -rniE 'correlationId|x-pramaan-correlation-id' src/   # -> ZERO

pnpm typecheck   # tsc --noEmit, exit 0
pnpm lint        # 0 errors (1 pre-existing img warning, unrelated)
pnpm test        # 93 files / 522 tests passed
pnpm build       # exit 0
git diff --check  # clean

Acceptance criterion "grep-zero cid in app" is met for all hand-authored app source; the lone residual is the generated backend mirror, owned by the functions cid rip-out + codegen sync.

Files changed

32 file(s), +77 / -740 lines