fix(mcp): scaffold middleware order mirrors web.New (Recover first, UUID v7)

internal/tools/scaffold.go

@@ -143,10 +143,13 @@ func Run() error {
 
 	srv := server.New(logger, cfg.Server,
 		server.WithMiddleware(
-			mw.RequestID(uuid.NewString),
+			// Same stack and order as web.New — Recover outermost, time-ordered
+			// request ID, then logging. The only deliberate difference is the
+			// env-gated allow-all CORS (corsMW) above, which web.New does not offer.
 			mw.Recover(logger),
-			corsMW,
+			mw.RequestID(newRequestID),
 			mw.RequestLogger(logger),
+			corsMW,
 		),
 	)
 
@@ -158,6 +161,16 @@ func Run() error {
 
 	return lc.Run()
 }
+
+// newRequestID returns a time-ordered UUID v7 (falling back to v4 on error),
+// matching web.New's request-ID generator.
+func newRequestID() string {
+	id, err := uuid.NewV7()
+	if err != nil {
+		return uuid.NewString()
+	}
+	return id.String()
+}
 `
 
 const tplHealth = `package wire