feat(observability): instrument AI + HTTP paths, serve /metrics on a side port (ADR-030, #15)

Wire the metrics package into the live paths and serve it:
- summarizer: per-endpoint latency by model/outcome(success|error|parse_error)/fallback + slog.
- youtube.FetchTranscript: latency by outcome (captions|none|rate_limited) + slog.
- chat: answer latency by model + slog.
- llm usage hook → token counts (prompt|completion) per model, wired in buildSummarizer/buildChat.
- oidc callback: login counter.
- cmdServe: wrap Router in metrics.HTTPMiddleware (request count + latency by bounded
  route pattern) and serve /metrics on TAPIR_METRICS_ADDR (default :9090), a SEPARATE
  port — never on the public app mux.

BDD: observability.feature scenarios un-pended + mapped. TDD: summarizer wiring tested
black-box via the /metrics scrape; metrics-not-on-public-mux asserted.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/adapters/youtube/captions.go

@@ -7,10 +7,13 @@ import (
 	"encoding/xml"
 	"fmt"
 	"io"
+	"log/slog"
 	"net/http"
 	"strings"
+	"time"
 
 	"gitea.d-ma.be/mathias/tapir/internal/domain"
+	"gitea.d-ma.be/mathias/tapir/internal/metrics"
 )
 
 // defaultPlayerBaseURL is the InnerTube / watch-page host. Overridable via
@@ -43,7 +46,35 @@ const maxCaptionBytes = 16 << 20 // 16 MiB
 // fetch, or an unparseable body all yield SourceNone rather than an error. Only
 // genuine transport (network) faults return an error. Audio download and
 // speech-to-text remain absent (ADR-007).
+// FetchTranscript times the caption fetch and records its latency by outcome
+// (ADR-030) before returning. Transport errors are surfaced to the caller and not
+// recorded as an outcome (logged upstream); the three resolved outcomes
+// captions|none|rate_limited are the ones that consume the scarce fetch budget.
 func (a *Adapter) FetchTranscript(ctx context.Context, v domain.Video) (domain.Transcript, error) {
+	start := time.Now()
+	tr, err := a.fetchTranscript(ctx, v)
+	if err == nil {
+		dur := time.Since(start)
+		outcome := captionOutcome(tr.Source)
+		metrics.ObserveCaptionFetch(outcome, dur)
+		slog.Default().Info("caption fetch", "video", v.ProviderVideoID, "outcome", outcome, "elapsed_ms", dur.Milliseconds())
+	}
+	return tr, err
+}
+
+// captionOutcome maps a transcript source to the metric outcome label.
+func captionOutcome(s domain.TranscriptSource) string {
+	switch s {
+	case domain.SourceCaptions:
+		return "captions"
+	case domain.SourceRateLimited:
+		return "rate_limited"
+	default:
+		return "none"
+	}
+}
+
+func (a *Adapter) fetchTranscript(ctx context.Context, v domain.Video) (domain.Transcript, error) {
 	client := a.plainClient()
 
 	tracks, err := a.captionTracks(ctx, client, v.ProviderVideoID)