Instrument SQLAlchemy in every service with a database

sanctions, notifier, ledger, insights and audit now call setup_telemetry
and instrument their engines with one SQLAlchemyInstrumentor call per
process (a second instrument() call is ignored, leaving that engine with
connect spans only). ledger and insights pass both their normal and
starved engines. The FastAPI services also get the server span, with the
same /healthz and receive/send exclusions as sanctions.

Compose: OTEL_SEMCONV_STABILITY_OPT_IN=http,database for the stable
attribute names, the OTLP endpoint moves to the shared env, and the four
newly instrumented services get the auth header from .env.observability.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docker-compose.yml

@@ -10,6 +10,10 @@ x-app-env: &app-env
   # Merged into the Resource by Resource.create(). deploy.sh sets DEPLOY_HASH
   # to the deployed git SHA; anything else (local runs) is "dev".
   OTEL_RESOURCE_ATTRIBUTES: service.version=${DEPLOY_HASH:-dev}
+  # Emit the stable semantic-convention names (http.request.method, url.path,
+  # db.query.text, ...) instead of the instrumentations' legacy defaults.
+  OTEL_SEMCONV_STABILITY_OPT_IN: http,database
+  OTEL_EXPORTER_OTLP_ENDPOINT: https://otlp.vione.cloud
 
 x-app-build: &app-build
   build:
@@ -102,6 +106,8 @@ services:
     environment:
       <<: *app-env
       SERVICE_NAME: ledger
+    env_file:
+      - .env.observability
     command: uvicorn services.ledger.app:app --host 0.0.0.0 --port 8001 --reload --no-access-log
     ports:
       - "8001:8001"
@@ -141,7 +147,6 @@ services:
       - ./scripts:/app/scripts
     environment:
       <<: *app-env
-      OTEL_EXPORTER_OTLP_ENDPOINT: https://otlp.vione.cloud
     env_file:
       - .env.observability
     command: uvicorn services.sanctions.app:app --host 0.0.0.0 --port 8003 --reload --no-access-log
@@ -164,6 +169,8 @@ services:
     environment:
       <<: *app-env
       SERVICE_NAME: insights
+    env_file:
+      - .env.observability
     command: uvicorn services.insights.app:app --host 0.0.0.0 --port 8004 --reload --no-access-log
     ports:
       - "8004:8004"
@@ -184,6 +191,8 @@ services:
     environment:
       <<: *app-env
       SERVICE_NAME: notifier
+    env_file:
+      - .env.observability
     command: uvicorn services.notifier.app:app --host 0.0.0.0 --port 8005 --reload --no-access-log
     ports:
       - "8005:8005"
@@ -204,6 +213,8 @@ services:
     environment:
       <<: *app-env
       SERVICE_NAME: audit
+    env_file:
+      - .env.observability
     command: python -m services.audit.worker
 
 volumes: