feat(log): 设备级 client_id 追踪，X-Client-Id 头校验后绑定请求级与访问日志

- 与 request_id 同一 UUID 白名单校验，非法/缺失丢弃不自生成
- CORS Allow-Headers 增加 X-Client-Id

Co-authored-by: Cursor <cursoragent@cursor.com>

request_trace_test.go

@@ -68,6 +68,18 @@ func TestRequestIdSharing(t *testing.T) {
 	}
 }
 
+// 设备级 client_id：与 request_id 同一 UUID 白名单口径——合法归一小写后绑定，非法/缺失丢弃（不自生成）
+func TestClientIdHeaderNormalize(t *testing.T) {
+	if got := normalizeRequestId("6F0A1B2C-3D4E-4F5A-8B6C-7D8E9F0A1B2C"); got != "6f0a1b2c-3d4e-4f5a-8b6c-7d8e9f0a1b2c" {
+		t.Fatalf("合法 X-Client-Id 应归一沿用，got %q", got)
+	}
+	for _, bad := range []string{"", "device-001", "a1b2c3d4e5f6", "evil\ninjection"} {
+		if normalizeRequestId(bad) != "" {
+			t.Fatalf("非法 X-Client-Id %q 应被丢弃", bad)
+		}
+	}
+}
+
 func TestViewSetsServerSentMsHeader(t *testing.T) {
 	rec := httptest.NewRecorder()
 	ctx := &Context{Resp: rec, RespData: Map{"status": 0}}