Add business spans and silence the frontend health poll

Manual INTERNAL spans for the business steps the auto-instrumentation
can't name: fraud.score_transaction, sanctions.lookup_watchlist,
ledger.settle and insights.aggregate_120d, with ledgerline.* attributes
(account, amount, risk score, match outcome). holder_name stays off the
spans. Each span starts after its handler's chaos flag reads and
injection points, and no chaos-derived values become attributes.

The gateway's /api/health/all fan-out now runs under
suppress_instrumentation: with the route excluded, its five downstream
/healthz calls were each a parentless root trace.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

services/gateway/app.py

@@ -8,6 +8,7 @@ from fastapi.responses import FileResponse, JSONResponse
 from fastapi.staticfiles import StaticFiles
 from pydantic import BaseModel, field_validator
 from opentelemetry.instrumentation.fastapi import FastAPIInstrumentor
+from opentelemetry.instrumentation.utils import suppress_instrumentation
 
 from common.chaos_flags import ALL_FLAGS, get_flags, set_flag, set_profile
 from common.logging_config import configure_logging
@@ -133,7 +134,10 @@ async def health_all():
         except httpx.RequestError:
             return name, "down"
 
-    results = await asyncio.gather(*[check(name, url) for name, url in DOWNSTREAM_URLS.items()])
+    # The route itself is in excluded_urls; without this its five downstream
+    # /healthz calls would each still be a parentless root trace.
+    with suppress_instrumentation():
+        results = await asyncio.gather(*[check(name, url) for name, url in DOWNSTREAM_URLS.items()])
     services = {"gateway": "ok", **dict(results)}
     return {"services": services}