fix(mcp): scaffold middleware order mirrors web.New (Recover first, UUID v7)

internal/index/builtins/README.md

@@ -277,10 +277,13 @@ func Run() error {
 
 	srv := server.New(logger, cfg.Server,
 		server.WithMiddleware(
-			mw.RequestID(uuid.NewString),
+			// Recover outermost, time-ordered request ID, then logging — same order
+			// as web.New. corsMW (env-gated allow-all) sits before auth so preflight
+			// OPTIONS short-circuit without hitting the auth middleware.
 			mw.Recover(logger),
-			corsMW,
+			mw.RequestID(newRequestID),
 			mw.RequestLogger(logger),
+			corsMW,
 			authjwt.AuthMiddleware(logger, signer, publicPaths),
 			authmw.EnrichmentMiddleware(logger, &claimsEnricher{}),
 		),
@@ -298,6 +301,15 @@ func Run() error {
 
 	return lc.Run()
 }
+
+// newRequestID returns a time-ordered UUID v7 (falling back to v4), matching web.New.
+func newRequestID() string {
+	id, err := uuid.NewV7()
+	if err != nil {
+		return uuid.NewString()
+	}
+	return id.String()
+}
 ```
 
 ## Feature hook