feat: add Swagger UI docs, custom CORS middleware, and request logging

- Add Swagger UI files and updated API spec for Family Safety Tracker
- Replace shelf_cors_headers with custom CORS middleware in server.dart
- Add request_logger middleware with timing for auth and geo routes
- Add REGISTRATION_SECRET_KEY to .env for registration validation
- Remove postgres port exposure from docker-compose.yml
- Update opencode.json model configuration
- Add crypto dependency and update Flutter web assets

bin/routes/geo_routes.dart

@@ -2,6 +2,7 @@ import 'package:shelf/shelf.dart';
 import 'package:shelf_router/shelf_router.dart';
 import '../database/database_provider.dart';
 import '../middleware/auth_middleware.dart';
+import '../middleware/request_logger.dart';
 import 'dart:convert';
 
 class GeoRoutes {
@@ -17,6 +18,7 @@ class GeoRoutes {
   }
 
   Future<Response> _updatePosition(Request request, String login) async {
+    final stopwatch = Stopwatch()..start();
     final id = request.url.queryParameters['id']!;
     final body = await request.readAsString();
     final data = jsonDecode(body);
@@ -26,10 +28,14 @@ class GeoRoutes {
 
     await database.updatePosition(id, x, y);
     await database.createLog(login, 'Updated position id=$id');
-    return Response(200, body: jsonEncode({'message': 'Position updated'}), headers: {'Content-Type': 'application/json'});
+    stopwatch.stop();
+    final response = Response(200, body: jsonEncode({'message': 'Position updated'}), headers: {'Content-Type': 'application/json'});
+    logRequest(method: 'PUT', url: '/geo', status: 200, duration: stopwatch.elapsed, body: body, responseHeaders: response.headers);
+    return response;
   }
 
   Future<Response> _createShare(Request request, String login) async {
+    final stopwatch = Stopwatch()..start();
     final body = await request.readAsString();
     final data = jsonDecode(body);
 
@@ -40,9 +46,12 @@ class GeoRoutes {
     final shareId = database.createShareId(position.id);
 
     await database.createLog(login, 'Created share link geo_id=${position.id}');
-    return Response(201, body: jsonEncode({
+    stopwatch.stop();
+    final response = Response(201, body: jsonEncode({
       'geo_id': position.id,
       'share_id': shareId
     }), headers: {'Content-Type': 'application/json'});
+    logRequest(method: 'POST', url: '/share', status: 201, duration: stopwatch.elapsed, body: body, responseHeaders: response.headers);
+    return response;
   }
 }