Log structured fields through a logger adapter

app.logger.info("message", key=value) appends the keyword arguments as
JSON encoded fields, so callers no longer format the values themselves.
All log calls use fixed messages and put variable values into fields.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

max/csrf.py

@@ -3,7 +3,6 @@ from functools import wraps
 from flask import request, session
 
 from max.crypto import constant_time_compare, get_random_string
-from max.log_format import format_log_fields
 from max.middlewares import BaseMiddleware, get_real_remote_addr
 
 CSRF_TOKEN_KEY = "csrf_token"
@@ -34,14 +33,12 @@ class CsrfMiddleware(BaseMiddleware):
         # Stateless check, so it also protects routes without a session (login)
         if not self.is_origin_allowed():
             self.app.logger.debug(
-                "Blocked cross-origin request %s",
-                format_log_fields(
-                    method=request.method,
-                    path=request.path,
-                    origin=request.headers.get("Origin"),
-                    sec_fetch_site=request.headers.get("Sec-Fetch-Site"),
-                    ip=get_real_remote_addr(self.app),
-                ),
+                "Blocked cross-origin request",
+                method=request.method,
+                path=request.path,
+                origin=request.headers.get("Origin"),
+                sec_fetch_site=request.headers.get("Sec-Fetch-Site"),
+                ip=get_real_remote_addr(self.app),
             )
             return "Cross-origin request blocked", 403