Logging: structured slog messages throughout, and WithLogger options so callers choose the logger

Log messages are lower-case event names with their details as key/value
attributes ("error" for errors), in place of formatted strings.

Loggable package take a WithLogger option as part of their "New*" call,
defaulting to slog.Default(). Each tags its lines with its `component`.

Some debug loggers print directly rather than using slog when in
terminal logging mode.

internal/findatender/api_test.go

@@ -312,9 +312,14 @@ func TestFetchURIDebugTrace(t *testing.T) {
 			if len(releases) != 1 {
 				t.Errorf("got %d releases, want 1", len(releases))
 			}
-			if !strings.Contains(logs.String(), "Resty") {
+			if !strings.Contains(logs.String(), "msg=fetched") &&
+				!strings.Contains(logs.String(), `"msg":"fetched"`) {
 				t.Errorf("no trace logged: %s", logs.String())
 			}
+			// Every field must be loggable (a *resty.Response isn't, as JSON).
+			if strings.Contains(logs.String(), "!ERROR") {
+				t.Errorf("a field could not be logged: %s", logs.String())
+			}
 		})
 	}
 }
@@ -387,7 +392,7 @@ func TestSafeUnpackReleases(t *testing.T) {
 			{"ocid": "ocds-3", "id": "3", "date": "2026-10-08", "tag": [], "initiationType": "tender"}
 		]
 	}`
-	pkg, err := safeUnpackReleases(responseFor(t, body))
+	pkg, err := safeUnpackReleases(slog.Default(), responseFor(t, body))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -424,7 +429,7 @@ func TestSafeUnpackReleasesPublishedDate(t *testing.T) {
 			if tt.date != "" {
 				body = `{"publishedDate":` + tt.date + `,"releases":[]}`
 			}
-			pkg, err := safeUnpackReleases(responseFor(t, body))
+			pkg, err := safeUnpackReleases(slog.Default(), responseFor(t, body))
 			if err != nil {
 				t.Fatal(err)
 			}
@@ -448,7 +453,7 @@ func TestSafeUnpackReleasesInvalidJSON(t *testing.T) {
 		"publisher array": `{"publisher": []}`,
 	} {
 		t.Run(name, func(t *testing.T) {
-			if _, err := safeUnpackReleases(responseFor(t, body)); err == nil {
+			if _, err := safeUnpackReleases(slog.Default(), responseFor(t, body)); err == nil {
 				t.Error("expected a decode error")
 			}
 		})