feat(ops): OpenTelemetry traces + metrics (RECOMMENDATIONS #5)

ASP.NET Core, outbound HttpClient (Gmail/Ollama), and Npgsql instrumentation with
an OTLP exporter that activates ONLY when Otel:Endpoint /
OTEL_EXPORTER_OTLP_ENDPOINT is configured — zero overhead otherwise. Logs remain
on Serilog. Adds a compose 'observability' profile running grafana/otel-lgtm
(Grafana+Tempo+Prometheus+Loki in one container, loopback :3000) with a
documented one-line enablement. 55/55 tests; vuln + format gates clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker-compose.yml

@@ -67,6 +67,8 @@ services:
       Ai__Mode: ${AI_MODE:-Disabled}
       # Points at the compose 'ollama' service when the ai profile is up; harmless otherwise.
       Ai__OllamaBaseUrl: ${OLLAMA_BASE_URL:-http://ollama:11434}
+      # OTLP export activates only when set (e.g. http://lgtm:4317 with the observability profile).
+      OTEL_EXPORTER_OTLP_ENDPOINT: ${OTEL_ENDPOINT:-}
       # Dev mode shows the dev banner and caps the initial sync. Set DEV_MODE=true
       # and MAX_MESSAGES=1000 in deploy/.env to exercise it in this Docker setup.
       App__DevMode: ${DEV_MODE:-false}
@@ -109,6 +111,16 @@ services:
     #           count: all
     #           capabilities: [gpu]
 
+  # Observability (RECOMMENDATIONS #5): all-in-one Grafana+Tempo+Prometheus+Loki.
+  # Enable with: docker compose --profile observability up -d
+  # then set OTEL_ENDPOINT=http://lgtm:4317 in deploy/.env and restart the api.
+  # Grafana UI: http://localhost:3000 (admin/admin on first run).
+  lgtm:
+    image: grafana/otel-lgtm
+    profiles: ["observability"]
+    ports:
+      - "127.0.0.1:3000:3000"
+
   # Optional reverse proxy. Enable with: docker compose --profile proxy up
   nginx:
     image: nginx:alpine