No metrics/observability instrumentation at all

[ndii-dev]

There's no Prometheus/OpenTelemetry/StatsD instrumentation anywhere in this service — no request latency histograms, no Horizon-call-duration metrics, no error-rate counters. Combined with the missing correlation IDs (separate issue), this makes the service effectively unobservable in production beyond raw access logs. Instrument the service properly.

Definition of done:

• Request latency and error-rate metrics exposed per route
• Horizon call latency/failure-rate tracked separately from overall request latency (so a slow Horizon vs a slow local bug are distinguishable)
• Metrics endpoint doesn't require the API key (operationally it needs to be scrapeable) but isn't itself sensitive

---

Before opening a PR for this issue, read CONTRIBUTING.md.

This is not a starter-issue. The Definition of done above is the full
acceptance criteria, not a subset to sample from — a PR that addresses part
of it is an unfinished issue, not a smaller one. Your PR must include, in
the PR description itself:

• Root cause / design-decision rationale in your own words — not a restatement of this issue
• Every Definition of done bullet above addressed explicitly, with a one-line note on how
• Evidence the code actually runs: pasted test/build output, a screen recording or before/after screenshots for UI changes, or real (non-mocked) logs for network/contract-facing work
• New or updated tests included and shown passing (paste the output)
• Any adjacent/related behavior this issue calls out re-verified, not assumed unaffected

PRs missing these will be sent back before review, not reviewed and rejected — please do this up front.

[heymide]

I've reviewed the issue and understand the requirements. I'd love to work on this and submit a clean PR that meets the acceptance criteria.