feat: Observability (metrics, tracing, request correlation)

[xernobyl]

Observability

• Metrics: Prometheus at GET /metrics when OTEL_METRICS_EXPORTER=prometheus. Hub metrics: event pipeline (discarded events, channel depth, fan-out duration), webhook delivery (enqueued, deliveries by status, duration histograms, disabled counts), River queue depth. HTTP metrics via otelhttp.
• Tracing: Optional OTLP or stdout when OTEL_TRACES_EXPORTER is set. HTTP spans via otelhttp; trace context (trace_id, span_id) and request_id added to structured logs when using *Context slog methods.
• Request correlation: X-Request-ID middleware (propagate or generate UUID v7, echo in response).
• Docs: New Metrics and Observability, env var reference for OTEL_*, suggested alerts and practices.

Metrics and tracing are opt-in; if env vars are unset, a startup warning is logged and /metrics is not registered.

Other

• README and auth docs: removed references to todo.md for OpenAPI.