Add observability baseline and auth load benchmarks

[gabedalmolin]

Summary

Add an operational observability baseline and reproducible auth lifecycle benchmarks so the repository exposes delivery proof beyond correctness alone.

Closes #42
Closes #43
Advances #41

What changed

• add a Prometheus-compatible /metrics endpoint and auth lifecycle counters for login, refresh, replay detection, rate-limit hits, and readiness failures
• add local Prometheus and Grafana assets, an observability guide, and a dashboard definition for the auth service
• add reproducible k6 auth lifecycle scenarios, a benchmark compose override, a committed summary JSON artifact, and a benchmark report
• fix the runtime entrypoint mismatch in package.json and Dockerfile so the compiled server path matches the build output
• refresh the README and benchmark documentation with operational proof links and the latest recorded baseline

Validation

• npm run lint
• npm run typecheck
• npm run build
• npm test
• npm run prisma:migrate:deploy
• npm run test:integration
• docker compose -f deploy/observability/docker-compose.yml config
• docker compose -f docker-compose.yml -f docker-compose.benchmark.yml config
• docker compose -f docker-compose.yml -f docker-compose.benchmark.yml up --build --abort-on-container-exit --exit-code-from k6 k6

Risks/Notes

• the benchmark report is a local Docker Compose baseline and should not be treated as a production capacity claim
• issue Ship a public demo environment for the auth API #40 remains blocked on Railway project configuration and a public demo URL, so issue Polish portfolio proof assets and repository narrative #41 is only partially advanced by this PR
• latest recorded baseline in this branch: 25.01 req/s, 684.36ms p95, and 900.44ms p99