feat(observability): instrument AI + HTTP paths, serve /metrics on a side port (ADR-030, #15)

Wire the metrics package into the live paths and serve it:
- summarizer: per-endpoint latency by model/outcome(success|error|parse_error)/fallback + slog.
- youtube.FetchTranscript: latency by outcome (captions|none|rate_limited) + slog.
- chat: answer latency by model + slog.
- llm usage hook → token counts (prompt|completion) per model, wired in buildSummarizer/buildChat.
- oidc callback: login counter.
- cmdServe: wrap Router in metrics.HTTPMiddleware (request count + latency by bounded
  route pattern) and serve /metrics on TAPIR_METRICS_ADDR (default :9090), a SEPARATE
  port — never on the public app mux.

BDD: observability.feature scenarios un-pended + mapped. TDD: summarizer wiring tested
black-box via the /metrics scrape; metrics-not-on-public-mux asserted.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/web/oidc/oidc.go

@@ -27,6 +27,7 @@ import (
 	"github.com/coreos/go-oidc/v3/oidc"
 	"golang.org/x/oauth2"
 
+	"gitea.d-ma.be/mathias/tapir/internal/metrics"
 	"gitea.d-ma.be/mathias/tapir/internal/web"
 )
 
@@ -253,6 +254,7 @@ func (d *DexAuth) handleCallback(w http.ResponseWriter, r *http.Request) {
 
 	user := web.User{Subject: idToken.Subject, Email: claims.Email}
 	d.setSessionCookie(w, d.encodeSession(user, d.now().Add(d.sessionTTL)))
+	metrics.IncLogin()
 	http.Redirect(w, r, "/", http.StatusFound)
 }