Reinstate logging with Winston

We removed it in 7f62be9af497c51e72310327e27ae93043594135 when we thought it might be causing production issues, but those were not due to Winston.

- Development: log debug messages in colour to the console
- Everything else: log JSON messages to a file in `/var/log/spotlight`

We are still using the Express dev logger in every environment. This is just a first pass.

Log rotation is not handled by the app.