feat(observability): expose dashboard API metrics

[tang-vu]

Why this matters

The dashboard API is the control plane for setup, model, extension, and health operations, but operators cannot scrape its own request rate or latency. This adds a dependency-free Prometheus endpoint that supports alerting and capacity diagnosis while deliberately labeling by FastAPI route template instead of raw URL, preventing extension/model IDs from creating unbounded time series.

Overlap check

Searched open and closed upstream PRs for Prometheus dashboard API, metrics endpoint, observability, and all changed production files. Closed PRs #1761/#1822 test and harden parsing of llama-server metrics; #2128 enables llama.cpp metrics on Windows. None instrument dashboard-api HTTP traffic. Open PRs #2731, #2736, and #2819 touch main.py for CSRF, key lifecycle, and Docker-probe fixes respectively; their behavior and test surfaces are independent from this middleware and /metrics route.

What changed

• expose unauthenticated local scrape endpoint GET /metrics in Prometheus 0.0.4 text format
• record request totals by method/route template/status, a global in-flight gauge, process start time, and cumulative latency histogram
• exclude /metrics scrapes from observations
• record error/cancellation completion through an ASGI finally boundary without swallowing exceptions
• document the observability surface

Regression test

python -m pytest -q tests/test_api_metrics.py

Also validated:

• python -m pytest -q tests/test_api_metrics.py tests/test_main.py (77 passed)
• python -m py_compile api_metrics.py main.py tests/test_api_metrics.py
• git diff --check