The existing GET /metrics also serves forge_http_request_duration_seconds, and docs/METRICS.md lists every family #3985

GET /metrics now also serves forge_http_request_duration_seconds, and docs/METRICS.md lists every family it serves. I couldn't run the type check: bun x tsc --noEmit failed in this sandbox with "bun is unable to write files to tempdir: ReadOnlyFileSystem", so it is unchecked. The new test/metrics-route.test.ts and the four test files named in the issue pass.

• The family: it is a histogram labelled by route pattern. It is built in the new src/metrics/forge.ts with openmetrics.ts, from route_timing rows for the last hour (the current hour bucket and the one before). Buckets are EDGES_MS converted to seconds, with _count, _sum and +Inf. The read is one primary-key range query.
• The route: the existing handler in src/http/api.ts appends the new text after the egress text, which is unchanged. No web-router route was added, and neither audit list nor reserved.ts changed.
• Content type: I kept text/plain; version=0.0.4 for the whole body, so there is no # EOF. I strip the # EOF that openMetrics adds. Access control, headers and no-store are as before.
• Docs: docs/METRICS.md has a table of type, labels and meaning for each family, plus a Prometheus scrape config that uses an admin ro token.
• Tests: one records a request in route_timing and checks that its bucket, count and sum move on /metrics. The other fails if the route serves a family that docs/METRICS.md does not list.

What I left out: the web server's in-memory pending writes aren't flushed on scrape, so a request shows up on /metrics about a second after it is made.

To try it: curl -H "authorization: Bearer $ADMIN_RO_TOKEN" $FORGE_URL/metrics.

Closes #3975

GET /metrics now also serves forge_http_request_duration_seconds, and docs/METRICS.md lists every family it serves. I couldn't run the type check: bun x tsc --noEmit failed in this sandbox with "bun is unable to write files to tempdir: ReadOnlyFileSystem", so it is unchecked. The new test/metrics-route.test.ts and the four test files named in the issue pass.

• The family: it is a histogram labelled by route pattern. It is built in the new src/metrics/forge.ts with openmetrics.ts, from route_timing rows for the last hour (the current hour bucket and the one before). Buckets are EDGES_MS converted to seconds, with _count, _sum and +Inf. The read is one primary-key range query.
• The route: the existing handler in src/http/api.ts appends the new text after the egress text, which is unchanged. No web-router route was added, and neither audit list nor reserved.ts changed.
• Content type: I kept text/plain; version=0.0.4 for the whole body, so there is no # EOF. I strip the # EOF that openMetrics adds. Access control, headers and no-store are as before.
• Docs: docs/METRICS.md has a table of type, labels and meaning for each family, plus a Prometheus scrape config that uses an admin ro token.
• Tests: one records a request in route_timing and checks that its bucket, count and sum move on /metrics. The other fails if the route serves a family that docs/METRICS.md does not list.

What I left out: the web server's in-memory pending writes aren't flushed on scrape, so a request shows up on /metrics about a second after it is made.

To try it: curl -H "authorization: Bearer $ADMIN_RO_TOKEN" $FORGE_URL/metrics.