feat(backend): log des appels API en mode debug (#89)

- Ajout LogRequestInterceptor (méthode, URL, query, body)
- Activé via LOG_API_REQUESTS=true
- Masquage des champs sensibles (password, smtp_password, token...)
- Enregistrement global dans main.ts, doc dans .env.example

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/src/main.ts

@@ -1,17 +1,18 @@
-import { NestFactory, Reflector } from '@nestjs/core';
+import { NestFactory } from '@nestjs/core';
 import { AppModule } from './app.module';
 import { ConfigService } from '@nestjs/config';
 import { SwaggerModule } from '@nestjs/swagger/dist/swagger-module';
 import { DocumentBuilder } from '@nestjs/swagger';
-import { AuthGuard } from './common/guards/auth.guard';
-import { JwtService } from '@nestjs/jwt';
-import { RolesGuard } from './common/guards/roles.guard';
 import { ValidationPipe } from '@nestjs/common';
+import { LogRequestInterceptor } from './common/interceptors/log-request.interceptor';
 
 async function bootstrap() {
   const app = await NestFactory.create(AppModule,
     { logger: ['error', 'warn', 'log', 'debug', 'verbose'] });
-  
+
+  // Log de chaque appel API si LOG_API_REQUESTS=true (mode debug)
+  app.useGlobalInterceptors(new LogRequestInterceptor());
+
   // Configuration CORS pour autoriser les requêtes depuis localhost (dev) et production
   app.enableCors({
     origin: true, // Autorise toutes les origines (dev) - à restreindre en prod