feat(obs): golden-signal metrics on /metrics + Prometheus scrape + Grafana dashboard (S-16c, refs #124)

Wire OTel metrics into the four remaining .NET services (acl, domain, event-subscriber,
projection-api) exactly as the BFF: ASP.NET Core + HttpClient instrumentation + the built-in
System.Runtime meter, exposed at /metrics via the Prometheus AspNetCore exporter (ADR-0024).
Prometheus scrapes one job per service; Grafana ships a pre-built 'Request path — golden
signals' dashboard (traffic/errors/latency/saturation). A verify-metrics CI step proves the
endpoints are scraped end to end.

infra/observability/prometheus/prometheus.yml

@@ -1,6 +1,7 @@
-# Prometheus scrape config (S-16a, ADR-0023). For the backplane slice it scrapes
-# only itself; the .NET services' /metrics scrape targets are added in S-16c
-# (#124) when the services expose metrics.
+# Prometheus scrape config (S-16c, ADR-0023). Each .NET service exposes OTel metrics
+# at /metrics (Prometheus text format); one scrape job per service, so the service is
+# identified by the `job` label in the golden-signal dashboard. Targets are reached by
+# compose service name on the shared `cg` network (internal port 8080).
 global:
   scrape_interval: 15s
 
@@ -8,3 +9,19 @@ scrape_configs:
   - job_name: prometheus
     static_configs:
       - targets: ['localhost:9090']
+
+  - job_name: acl
+    static_configs:
+      - targets: ['acl:8080']
+  - job_name: domain
+    static_configs:
+      - targets: ['domain:8080']
+  - job_name: bff
+    static_configs:
+      - targets: ['bff:8080']
+  - job_name: event-subscriber
+    static_configs:
+      - targets: ['event-subscriber:8080']
+  - job_name: projection-api
+    static_configs:
+      - targets: ['projection-api:8080']