Expose OTel metrics on :9464 for Prometheus to scrape

Alloy 404s OTLP metrics, so each service gets a MeterProvider with a
PrometheusMetricReader (same Resource as traces) served by
prometheus_client on its own port instead of a FastAPI route: gateway's
port 8000 is publicly routed by Traefik, and the audit worker has no HTTP
app. Host/port come from OTEL_EXPORTER_PROMETHEUS_HOST/PORT. Setting the
provider before the instrumentors also turns on their built-in HTTP and
DB pool metrics.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

requirements.txt

@@ -11,3 +11,5 @@ python-multipart==0.0.20
 structlog==25.5.0
 opentelemetry-distro==0.66b1
 opentelemetry-exporter-otlp==1.45.1
+opentelemetry-exporter-prometheus==0.66b1
+prometheus-client==0.26.0