feat(observability): instrument AI + HTTP paths, serve /metrics on a side port (ADR-030, #15)

Wire the metrics package into the live paths and serve it:
- summarizer: per-endpoint latency by model/outcome(success|error|parse_error)/fallback + slog.
- youtube.FetchTranscript: latency by outcome (captions|none|rate_limited) + slog.
- chat: answer latency by model + slog.
- llm usage hook → token counts (prompt|completion) per model, wired in buildSummarizer/buildChat.
- oidc callback: login counter.
- cmdServe: wrap Router in metrics.HTTPMiddleware (request count + latency by bounded
  route pattern) and serve /metrics on TAPIR_METRICS_ADDR (default :9090), a SEPARATE
  port — never on the public app mux.

BDD: observability.feature scenarios un-pended + mapped. TDD: summarizer wiring tested
black-box via the /metrics scrape; metrics-not-on-public-mux asserted.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/web/handlers_test.go

@@ -524,3 +524,12 @@ func TestListAutoModeBannerCopy(t *testing.T) {
 	require.Contains(t, html, "land gradually")
 	require.NotContains(t, html, "are not summarized automatically")
 }
+
+// TestMetricsNotOnPublicMux: the public app router exposes no /metrics route —
+// Prometheus is served on the dedicated metrics port only (ADR-030, security R6).
+func TestMetricsNotOnPublicMux(t *testing.T) {
+	app := newApp(t)
+	resetDB(t, rawPool(t))
+	rec := do(t, app, httptest.NewRequest(http.MethodGet, "/metrics", nil))
+	require.Equal(t, http.StatusNotFound, rec.Code, "/metrics must not be on the public mux")
+}