feat(configuration): add request timing log

One INFO line per API request: method, handler pattern, status, ms.
No ids or query strings in the line. Refs #40.

readme.md

@@ -846,6 +846,13 @@ Configuration comes from environment variables:
 | `APP_PSN_TOKEN_KEY` | Key for the stored PlayStation tokens, `openssl rand -base64 32` (optional; empty = PlayStation link off) |
 | `DB_PASSWORD` | Local PostgreSQL password |
 
+### Request timing log
+
+`RequestTimingFilter` writes one INFO line to stdout per API request: method, handler path pattern, status and
+duration, e.g. `GET /api/library/games 200 28 ms`. The pattern is `-` when no handler matched (e.g. a `401` before
+routing). The line never holds ids, query strings, user data or tokens. `/actuator/**` is skipped. An exception
+that leaves the filter chain is logged as `500`.
+
 ## Tests
 
 ```bash