[Monitoring] Session ID preservation

[2witstudios]

Summary

api_metrics schema supports sessionId and requestId, but middleware bulk flush drops both fields.

Evidence

• Schema includes correlation fields:
  • packages/db/src/schema/monitoring.ts:91 (sessionId)
  • packages/db/src/schema/monitoring.ts:97 (requestId)
• Middleware collector model omits them:
  • apps/web/src/middleware/monitoring.ts:15 (RequestMetrics lacks sessionId and requestId)
• Track path has access to correlation values (requestId, context.sessionId) but does not persist them in buffered metrics:
  • apps/web/src/middleware/monitoring.ts:299, apps/web/src/middleware/monitoring.ts:328
• Flush insert omits both fields:
  • apps/web/src/middleware/monitoring.ts:88
• Ingest route path does persist both fields when enabled:
  • apps/web/src/app/api/internal/monitoring/ingest/route.ts:82 and apps/web/src/app/api/internal/monitoring/ingest/route.ts:86

Problem

Incident-response traceability is weaker on the local middleware flush path because rows cannot always be correlated to session/request journeys.

Enterprise Impact

• “Weak traceability” concern due to missing persisted correlation IDs.

Proposed Work

1. Add sessionId?: string and requestId?: string to middleware RequestMetrics.
2. Populate those fields in metricsCollector.track(...) from context.sessionId and generated requestId.
3. Persist both fields in db.insert(apiMetrics).values(...) during flush.
4. Add regression tests for collector mapping.

Acceptance Criteria

• Buffered middleware metrics persist both sessionId and requestId when available.
• No regression in existing monitoring behavior/performance.
• Tests validate that these fields are included in DB writes.