feat(obs): golden-signal metrics on /metrics + Prometheus scrape + Grafana dashboard (S-16c, refs #124)

Wire OTel metrics into the four remaining .NET services (acl, domain, event-subscriber,
projection-api) exactly as the BFF: ASP.NET Core + HttpClient instrumentation + the built-in
System.Runtime meter, exposed at /metrics via the Prometheus AspNetCore exporter (ADR-0024).
Prometheus scrapes one job per service; Grafana ships a pre-built 'Request path — golden
signals' dashboard (traffic/errors/latency/saturation). A verify-metrics CI step proves the
endpoints are scraped end to end.

services/domain/Big.Api/Program.cs

@@ -1,6 +1,7 @@
 using Big.Application;
 using Big.Domain;
 using Big.Infrastructure;
+using OpenTelemetry.Metrics;
 using OpenTelemetry.Resources;
 using OpenTelemetry.Trace;
 using Quartz;
@@ -18,7 +19,16 @@ builder.Services.AddOpenTelemetry()
     .WithTracing(tracing => tracing
         .AddAspNetCoreInstrumentation(o => o.Filter = ctx => ctx.Request.Path != "/health")
         .AddHttpClientInstrumentation()
-        .AddOtlpExporter());
+        .AddOtlpExporter())
+    // OpenTelemetry metrics (S-16c, ADR-0023): golden signals for the request path —
+    // http.server.request.duration (traffic/errors/latency) + http.client.* for downstream hops, plus
+    // the built-in System.Runtime meter for saturation (GC, CPU, thread pool). Prometheus scrapes these
+    // from /metrics (mapped below); metrics aren't pushed over OTLP, so no collector hop (ADR-0023).
+    .WithMetrics(metrics => metrics
+        .AddAspNetCoreInstrumentation()
+        .AddHttpClientInstrumentation()
+        .AddMeter("System.Runtime")
+        .AddPrometheusExporter());
 
 // Options bound from configuration (compose sets Flowable__* and Acl__* env vars).
 builder.Services.AddSingleton(sp => sp.GetRequiredService<IConfiguration>()
@@ -84,6 +94,9 @@ var app = builder.Build();
 
 app.MapGet("/health", () => "Healthy");
 
+// Prometheus scrape endpoint (S-16c): exposes the OTel metrics above in Prometheus text format.
+app.MapPrometheusScrapingEndpoint();
+
 // Submit a registration. The aggregate is created (INGEDIEND) and the registratie process started;
 // the zaak is opened later, off the request path, by the worker — so this returns 202 Accepted with
 // a location to read the registration's progress (ADR-0009, eventual consistency).