refactor!: make addrkit a multi-city address normalizer

- remove the events/outages module, ArcGIS adapter, portal config and event statuses
- add a configurable city dictionary/parser and make City part of StreetKey
- seed: read city/city_name, namespace IDs by city, keep structures distinct
- fix reliability: schema v2 with fail-closed load, deterministic ordering,
  input limits, config validation, atomic DB publish, LLM response caps
- add read-only shadow mode comparing the old ES path with addrkit
- breaking: registry.db must be re-seeded; config has no portal section

internal/adapters/httpapi/middleware.go

@@ -14,10 +14,13 @@ type ctxKey int
 const requestIDKey ctxKey = 0
 
 // requestIDMW assigns a request id (for correlation in logs) and echoes it.
+// A client-supplied id is accepted only when it is short and well-formed; the
+// header ends up in logs, so accepting arbitrary bytes would be an injection
+// and log-flooding vector.
 func requestIDMW(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		id := r.Header.Get("X-Request-Id")
-		if id == "" {
+		if !validRequestID(id) {
 			id = newRequestID()
 		}
 		w.Header().Set("X-Request-Id", id)
@@ -26,6 +29,23 @@ func requestIDMW(next http.Handler) http.Handler {
 	})
 }
 
+const maxRequestIDLen = 128
+
+func validRequestID(id string) bool {
+	if id == "" || len(id) > maxRequestIDLen {
+		return false
+	}
+	for _, r := range id {
+		switch {
+		case r >= 'a' && r <= 'z', r >= 'A' && r <= 'Z', r >= '0' && r <= '9':
+		case r == '-', r == '_', r == '.':
+		default:
+			return false
+		}
+	}
+	return true
+}
+
 // loggingMW logs one line per request with method, path, status and duration.
 // It records no addresses (PII) — only routing metadata.
 func loggingMW(log *slog.Logger) func(http.Handler) http.Handler {
@@ -45,8 +65,10 @@ func loggingMW(log *slog.Logger) func(http.Handler) http.Handler {
 	}
 }
 
-// timeoutMW bounds the whole request, so a slow portal cannot tie up a
-// goroutine indefinitely.
+// timeoutMW bounds the whole request by setting a context deadline. Handlers
+// and adapters that talk to the network honour it; purely CPU-bound handlers
+// are additionally bounded by input limits and the HTTP server's read/write
+// timeouts in cmd/addrkitd.
 func timeoutMW(d time.Duration) func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {