bug(a2a-server): logger ignores LOG_LEVEL and logs request bodies without redaction

## What happened?

`packages/a2a-server/src/utils/logger.ts:9-26` hardcodes `level: 'info'`, console-only transport, no `splat`/redaction — while `app.ts:217-225` allowlists `LOG_LEVEL` but never applies it. Meanwhile `app.ts:134` and `executor.ts:495-497` log full `req.body` / `userMessage`:

```ts
const logger = winston.createLogger({
level: 'info',
...
transports: [new winston.transports.Console()],
```

Impact: `LOG_LEVEL=debug` is a no-op (cannot debug prod), no file rotation, and secrets/tokens in bodies persist to stdout.

## What did you expect to happen?

`level: process.env['LOG_LEVEL'] ?? 'info'`, `format.splat()` + redact list (`authorization`, `apiKey`, tokens), optional file transport, and redaction of `req.body`/`userMessage` logs.

## Client information

- Repo `google-gemini/gemini-cli` @ `main` `9c1b0a610`
- Area `packages/a2a-server/src/utils/logger.ts:9-26`, `packages/a2a-server/src/http/app.ts:134,217-225`
- Platform: A2A server ops

## Login information

N/A — repro: `LOG_LEVEL=debug` still info-only; log output contains bearer token.

## Anything else we need to know?

Fix direction: wire env level, redaction formatter, file-transport option; tests asserting level switch + token redaction.

Start with packages/a2a-server/src/utils/logger.ts:9-26 and the LOG_LEVEL handling in packages/a2a-server/src/http/app.ts:217-225. Then inspect app.ts:134 and executor.ts:495-497 to trace the request-body logging. Done means LOG_LEVEL affects the logger, sensitive fields are redacted, the requested transport behavior is handled, and tests cover level switching and token redaction.

Written by the indexing model from the issue text.