feat: add app_config table with runtime log level control and POS structured logging

- New app_config key-value table for system settings, with in-memory cache (mirrors ModuleService pattern)
- GET/PATCH /v1/config endpoints for reading and updating config (settings.view/settings.edit permissions)
- Runtime log level: PATCH /v1/config/log_level applies immediately, persists across restarts
- Startup loads log level from DB in onReady hook (env var is default, DB overrides)
- Add structured request.log.info() to POS routes: transaction create/complete/void, drawer open/close, discount create/update/delete

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

packages/backend/src/routes/v1/drawer.ts

@@ -9,6 +9,7 @@ export const drawerRoutes: FastifyPluginAsync = async (app) => {
       return reply.status(400).send({ error: { message: 'Validation failed', details: parsed.error.flatten(), statusCode: 400 } })
     }
     const session = await DrawerService.open(app.db, parsed.data, request.user.id)
+    request.log.info({ drawerSessionId: session.id, locationId: parsed.data.locationId, openingBalance: parsed.data.openingBalance, userId: request.user.id }, 'Drawer opened')
     return reply.status(201).send(session)
   })
 
@@ -19,6 +20,7 @@ export const drawerRoutes: FastifyPluginAsync = async (app) => {
       return reply.status(400).send({ error: { message: 'Validation failed', details: parsed.error.flatten(), statusCode: 400 } })
     }
     const session = await DrawerService.close(app.db, id, parsed.data, request.user.id)
+    request.log.info({ drawerSessionId: id, closingBalance: parsed.data.closingBalance, expectedBalance: session.expectedBalance, overShort: session.overShort, closedBy: request.user.id }, 'Drawer closed')
     return reply.send(session)
   })