Add optional Prometheus metrics endpoint

[danbryan]

Summary

Adds an opt-in Prometheus endpoint to the signer. A metrics config block
enables an HTTP listener serving GET /metrics with signer metrics plus the
standard Go and process collectors. Nothing changes when the block is absent:
collection is always on, serving is opt-in, and no existing behavior or config
is touched.

metrics:
  listen: 0.0.0.0:8545

Also defaults the file backend algorithm to ed25519, which the README
and the kms init template already document as the default; before this
change a backend: file key without an explicit algorithm failed at
startup with file: unknown key type.

Motivation

A remote signer is the one component a validator cannot see from the chain
side until blocks are already being missed. Operators need to alert on the
signer itself: is it connected, is it signing, did the double-sign guard
refuse something, is the key backend healthy, and how fast is signing.

Metrics

A reasonable default set, based on surveying what the remote signers in the
ecosystem expose and what operators alert on. All series are prefixed kms_,
and signer series carry chain_id, since one process can sign for several
chains. Full reference with starter alert rules is in docs/metrics.md.

Group	Metrics
Connection	kms_validator_connected, kms_validator_connected_since_timestamp_seconds, kms_validator_dials_total{result}
Signing	kms_requests_total{type,result} where result="refused" marks a double-sign-guard decline, kms_sign_duration_seconds{type}, kms_last_signed_height/_round/_timestamp_seconds{type}
Double-sign state	kms_sign_state_height/_round/_step mirroring the persisted FilePV floor
Key backend	kms_backend_sign_duration_seconds{backend,algorithm}, kms_backend_errors_total{backend,algorithm}; the pkcs11 and awskms backends put an HSM or a network API in the signing hot path, so this is where their health shows
Metadata	kms_build_info{version,go_version}, kms_key_info{chain_id,backend,algorithm,address} with the public consensus address, so operators can assert the signer holds the key they expect

Plus the stock go_* and process_* collectors from promhttp.

[greptile-apps]

Greptile Summary

The PR adds an opt-in Prometheus endpoint and instruments validator connectivity, signing requests, backend operations, signing state, and key/build metadata. It also makes Ed25519 the effective default for file-backed consensus keys.

Confidence Score: 5/5

The PR appears safe to merge because no blocking failure remains.

No blocking failure remains.

Important Files Changed

Filename	Overview
internal/manager/manager.go	Adds validator connection, dial, request, signing-latency, last-signature, and sign-state metrics.
internal/metrics/metrics.go	Defines the private Prometheus registry, collectors, HTTP server, and backend signer instrumentation.
cmd/kms/main.go	Starts and closes the optional metrics listener from the configured metrics block.
internal/app/build.go	Wraps consensus signers with backend metrics, publishes key metadata, and defaults file keys to Ed25519.
config/config.go	Adds the optional metrics listener configuration schema.

_{Reviews (2): Last reviewed commit: "Add optional Prometheus metrics endpoint" | Re-trigger Greptile}

[danbryan]

@greptileai review please