fix: lazy-initialize api-logger to prevent EACCES in CI environments

The DailyRotateFile transport was creating directories at module load
time, causing EACCES permission errors when tests import modules that
transitively reach api-logger.ts.

Refactored to use a Proxy that lazily initializes the winston logger
on first method call. This eliminates side effects during module
loading while maintaining the same public API.

src/server/logging/api-logger.ts

@@ -8,6 +8,18 @@ import { sanitizeObject } from '../../utils/sensitiveDataMasking';
 const LOG_RETENTION = '30d';
 const LOG_MAX_SIZE = '50m';
 
+let _logger: winston.Logger | null = null;
+
+/**
+ * Lazily initializes the API logger on first access.
+ * Avoids creating directories and file transports at module load time,
+ * preventing EACCES errors in CI/test environments.
+ */
+function getLogger(): winston.Logger {
+  if (_logger) {
+    return _logger;
+  }
+
   const agentDir = getAgentDir();
 
   if (!fs.existsSync(agentDir)) {
@@ -68,12 +80,27 @@ consoleTransport.on('error', (error) => {
     console.error('Console API transport error', error);
   });
 
-export const apiLogger = winston.createLogger({
+  _logger = winston.createLogger({
     level: 'debug',
     transports: [consoleTransport, rotateTransport],
     exitOnError: false,
   });
 
+  return _logger;
+}
+
+/** Lazily-initialized API logger instance. */
+export const apiLogger = new Proxy({} as winston.Logger, {
+  get(_target, prop: string) {
+    const logger = getLogger();
+    const value = logger[prop as keyof winston.Logger];
+    if (typeof value === 'function') {
+      return value.bind(logger);
+    }
+    return value;
+  },
+});
+
 /**
  * Safely serialize a value for API logging.
  * Truncates very large bodies to avoid excessive log sizes.