fix: replace log.Printf with structured slog logging in auth and ratelimit modules

auth.go

@@ -5,7 +5,6 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"log"
 	"log/slog"
 	"net/http"
 	"strings"
@@ -71,7 +70,7 @@ func handleLogin(fetcher UserFetcher, secret []byte) http.HandlerFunc {
 				writeJSON(w, http.StatusUnauthorized, map[string]string{"error": "invalid email or password"})
 				return
 			}
-			log.Printf("login: database error: %v", err)
+			slog.Error("login: database error", "error", err)
 			writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "internal server error"})
 			return
 		}
@@ -82,14 +81,14 @@ func handleLogin(fetcher UserFetcher, secret []byte) http.HandlerFunc {
 				writeJSON(w, http.StatusUnauthorized, map[string]string{"error": "invalid email or password"})
 				return
 			}
-			log.Printf("login: bcrypt error: %v", err)
+			slog.Error("login: bcrypt error", "error", err)
 			writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "internal server error"})
 			return
 		}
 
 		tokenStr, err := generateJWT(user, secret)
 		if err != nil {
-			log.Printf("login: failed to generate JWT: %v", err)
+			slog.Error("token generation failed", "error", err)
 			writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "internal server error"})
 			return
 		}
@@ -161,8 +160,14 @@ func requireAuth(secret []byte) func(http.Handler) http.Handler {
 				return secret, nil
 			}, jwt.WithValidMethods([]string{"HS256"}), jwt.WithIssuer("vehicle-positions-api"))
 
-			if err != nil || !token.Valid {
-				log.Printf("auth: token validation failed: %v", err)
+			if err != nil {
+				slog.Warn("token validation failed", "error", err)
+				writeJSON(w, http.StatusUnauthorized, map[string]string{"error": "invalid token"})
+				return
+			}
+
+			if !token.Valid {
+				slog.Warn("token validation failed: token marked invalid")
 				writeJSON(w, http.StatusUnauthorized, map[string]string{"error": "invalid token"})
 				return
 			}

ratelimit.go

@@ -1,7 +1,7 @@
 package main
 
 import (
-	"log"
+	"log/slog"
 	"sync"
 	"time"
 
@@ -46,7 +46,7 @@ func (vrl *VehicleRateLimiter) Allow(key string) bool {
 	entry, ok := vrl.limiters[key]
 	if !ok {
 		if len(vrl.limiters) >= maxTrackedRates {
-			log.Printf("rate limiter at capacity (%d entries), allowing untracked key %q", maxTrackedRates, key)
+			slog.Warn("rate limiter at capacity, allowing untracked key", "capacity", maxTrackedRates, "key", key)
 			return true
 		}
 		entry = &rateLimiterEntry{