feat(p9): tenant-scoped /metrics + observability smoke; slice-4 verification green

Task O.4: GET /metrics (session-auth) returns the caller tenant's counters
(interactions by kind/status, outbound by status, AI jobs + cost, tickets,
meetings, inbox, audit-link count) via findScope + Prisma groupBy — no cross-tenant
totals — plus a global relay-lag section. smoke-observability proves the mandated
gate end to end: x-trace-id response header, event correlationId == request trace,
audit link in DB, /metrics counters. Slice-4 verification: 122 tests green, builds,
boundary clean, observability smoke + all prior smokes pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/iios-service/src/app.module.ts

@@ -14,6 +14,7 @@ import { AiModule } from './ai/ai.module';
 import { CalendarModule } from './calendar/calendar.module';
 import { CapabilityModule } from './capability/capability.module';
 import { HealthController } from './health.controller';
+import { MetricsController } from './observability/metrics.controller';
 import { DevController } from './dev/dev.controller';
 
 @Module({
@@ -33,6 +34,6 @@ import { DevController } from './dev/dev.controller';
     CalendarModule,
     CapabilityModule,
   ],
-  controllers: [HealthController, DevController],
+  controllers: [HealthController, MetricsController, DevController],
 })
 export class AppModule {}