feat(telemetry): expose OTel metrics via Prometheus /v1/metrics endpoint

[cdoern]

What

Adds an optional Prometheus scrape endpoint at /v1/metrics that exposes the existing OTel metrics in Prometheus exposition format, alongside the current OTLP push path. This unblocks scrape-based monitoring systems that need a Prometheus-compatible endpoint rather than OTLP push.

Resolves RHAIENG-5156.

How

• Dependency: add opentelemetry-exporter-prometheus (pulls in prometheus-client).
• setup_telemetry() (src/ogx/telemetry/__init__.py): now builds a list of metric readers — the existing OTLP PeriodicExportingMetricReader when OTEL_EXPORTER_OTLP_ENDPOINT is set, plus a PrometheusMetricReader when OGX_PROMETHEUS_ENABLED is truthy. Both attach to a single global MeterProvider, so the two export paths run independently.
• Endpoint (src/ogx_api/inspect_api/fastapi_routes.py): GET /v1/metrics is declared on the Inspect API router alongside /v1/health and /v1/version. It serves prometheus_client.generate_latest() with the Prometheus content type, opts out of auth via PUBLIC_ROUTE_KEY, and returns 404 when the feature is disabled.
• Middleware exclusions: /v1/metrics is added to _EXCLUDED_PATHS in RequestMetricsMiddleware so scrapes don't inflate request counters. Auth is handled automatically by PUBLIC_ROUTE_KEY (no manual bypass needed, since the route is a registered API route).

Acceptance criteria

• When enabled, OGX exposes all existing OTel metrics at /v1/metrics in Prometheus exposition format
• The endpoint does not require authentication
• Enabled/disabled via OGX_PROMETHEUS_ENABLED
• OTLP push continues to work independently (both paths active simultaneously)
• Existing unit and integration tests continue to pass
• New unit test validates Prometheus format output

Test plan

Unit tests (tests/unit/telemetry/test_prometheus_metrics.py, 17 cases): env-flag parsing, Prometheus-format exposition with labels/values, the route via TestClient (200 + text/plain when enabled, 404 when disabled), PUBLIC_ROUTE_KEY presence, and the _EXCLUDED_PATHS guard.

uv run pytest tests/unit/telemetry/ -q
# 17 passed

Integration tests (tests/integration/inspect/test_metrics_endpoint.py, server mode): scrape the live /v1/metrics over raw HTTP, assert Prometheus format and ogx_requests_total, no-auth access, and that the metrics route is not self-counted. scripts/integration-tests.sh sets OGX_PROMETHEUS_ENABLED for native server-mode runs; the tests skip otherwise.

uv run --no-sync ./scripts/integration-tests.sh \
  --stack-config server:ci-tests --setup gpt \
  --file tests/integration/inspect/test_metrics_endpoint.py
# 3 passed

Manual run against a live server confirmed 200 + Content-Type: text/plain; version=1.0.0; charset=utf-8, ogx_requests_total / ogx_request_duration_seconds present, scrapes excluded from counters, and 404 when the flag is unset.

🤖 Generated with Claude Code

[rhdedgar]

Nice, this covers all the criteria from RHAIENG-5156. +1

[mergify]

This pull request has merge conflicts that must be resolved before it can be merged. @cdoern please rebase it. https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork