feat(api): export metrics over OTLP beside traces

[mforce]

Closes #215. Builds on #226 (merged): same Otlp:Endpoint gate, same eager validation, same fake-collector test rig.

What

• .WithMetrics() beside the existing tracing: ASP.NET Core request metrics (http.server.request.duration, Kestrel), .NET runtime (GC, thread pool, exceptions), Npgsql and Microsoft.EntityFrameworkCore meters. New package: OpenTelemetry.Instrumentation.Runtime; lock files synced.
• Endpoint unset = no exporter — behavior identical to today (meters still exist in-process for anyone who attaches, nothing leaves).
• OtlpOptions.ResolveMetricsEndpoint — /v1/metrics appended for http/protobuf through the same UriBuilder path as traces (shared ResolveSignalEndpoint; query strings survive, no double-append).
• Fake collector v2 — captures bodies per signal path since traces + metrics arrive as separate POSTs in nondeterministic order; listener faults still surface through the wait instead of a generic timeout.
• Boot line reports both signal endpoints; deploy/.env.example documents the meter set (issue AC) and notes that request-duration histograms include health probes — the metrics side has no per-request filter; aggregated and low-cardinality, unlike the per-probe spans feat(api): activate the telemetry pipeline — OTLP export, request logs, TraceId correlation #226 filters out.

Decision recorded in #215: OTLP push, no Prometheus scrape endpoint (single container behind Cloudflare — a scrape port would need its own auth story).

Tests

5 new: 4 endpoint-resolution facts (append-once, vendor base path, grpc untouched) + a metrics export smoke test (flush forced by host disposal, payload must carry the Cluckwork.Api service name). Traces smoke test re-verified through the collector rewrite.

Suite: 732 green, integration run twice, build clean (warnings-as-errors).

[mforce]

Review round (repo policy: codex + 2 Claude agents + pi)

Accepted → fixed in 3ab4a56:

Finding	Source	Fix
Cross-signal endpoint foot-gun: Otlp:Endpoint=…/v1/traces sends metrics to /v1/traces/v1/metrics → silent collector 404	agent (Important)	http/protobuf endpoints must be the BASE url — any known signal suffix now fails at boot with a pointed message; 4 rejection facts. Supersedes #226's append-once tolerance (two signals on one endpoint = suffixed URL can never be right)
Smoke test proved "a metrics payload", not the required meters	codex, agent	driver is a login POST (real DB round-trip); payload must carry http.server.request.duration, dotnet.gc.collections, db.client.operation.duration, microsoft.entityframeworkcore — names taken from a real export dump, not guessed
Resource + exporter config duplicated across signals; metrics endpoint resolved twice; guards inconsistent	pi, cavecrew (5 findings, converging)	one ConfigureResource on the OTel builder (the intended API), one exporter-recipe closure, cached otlpMetricsEndpoint, uniform is not null guards
Docs understate the meter set — AddAspNetCoreInstrumentation subscribes ALL 13 built-in ASP.NET Core meters (rate limiting, auth, Identity, memory pool incl.)	agent (verified against Instrumentation.AspNetCore 1.17.0 source)	.env.example + code comment now tell the truth; meters kept — this app uses rate limiting, JWT auth, and Identity, so those series are useful, and all are low-cardinality
No temporality/interval guidance for delta-preferring vendors	agent (minor)	.env.example documents the OTEL_EXPORTER_OTLP_METRICS_TEMPORALITY_PREFERENCE / OTEL_METRIC_EXPORT_INTERVAL env overrides
Metrics resolution facts thinner than trace facts	agent (minor)	theories reworked to assert BOTH signals per endpoint row

Rejected: swapping OpenTelemetry.Instrumentation.Runtime for a bare AddMeter("System.Runtime") (agent minor) — the package is the framework facility; TFM differences stay its problem.

Reviewer verification highlights (agent 1 checked shipped assemblies, not docs): Npgsql 10.0.3 meter name Npgsql ✓, EF Core 10 meter Microsoft.EntityFrameworkCore ✓, Runtime 1.17.0 forwards to built-in System.Runtime meter with modern dotnet.* semconv ✓.

Suite after fixes: 734 green, integration run twice, build clean.