Log appCode and from address in orderbook request_summary

[squadgazzz]

Description

When investigating traffic spikes on /api/v1/quote there's no way to tell whether elevated traffic is from a known integrator because the partner-identifying fields (appCode in appData, and the from address) live inside the POST body and aren't captured in the request_summary log. WAF CloudWatch logs also don't capture POST body, so today the only way to attribute traffic to a partner is to ask them directly. This change adds both fields to request_summary so future DDoS investigations can be completed entirely in Victoria Logs.

Changes

• Added OrderCreationAppData::app_code() helper that extracts the appCode field from the full app data JSON
• Added RequestMetadata attached to responses from post_quote_handler and post_order_handler
• summarize_request middleware now logs app_code and from fields (both default to unset for endpoints that don't carry them)

How to test

New unit tests. Then, use CloudWatch with the updated query.

[gemini-code-assist]

Code Review

This pull request implements traffic attribution by extracting appCode and sender addresses from order and quote requests for logging. It adds an app_code helper to OrderCreationAppData, introduces a RequestMetadata struct, and updates the request middleware and handlers to capture and log these fields. No critical issues found.

[jmg-duarte]

No blockers

The doc comment, IMO could be better; the rest is just nits/suggestions

[jmg-duarte]

Suggested change

	/// Returns the `appCode` field from the full app data JSON, if present.
	/// Returns `None` when only the hash is provided, when parsing fails, or
	/// when the field is absent.
	/// If the full app data is present, returns the app code; will return `None` in any other case (not present, parsing failure, etc).

[jmg-duarte]

maybe?

Suggested change

	let full = match self {
	Self::Hash { .. } => return None,
	Self::Full { full } | Self::Both { full, .. } => full,
	};
	let (Self::Full { full } | Self::Both { full, .. }) = self else {
	return None;
	};

[jmg-duarte]

this and post_quote look like middleware to me, did you explore that route or you think its overkill?