Instrument SQLAlchemy in every service with a database

sanctions, notifier, ledger, insights and audit now call setup_telemetry
and instrument their engines with one SQLAlchemyInstrumentor call per
process (a second instrument() call is ignored, leaving that engine with
connect spans only). ledger and insights pass both their normal and
starved engines. The FastAPI services also get the server span, with the
same /healthz and receive/send exclusions as sanctions.

Compose: OTEL_SEMCONV_STABILITY_OPT_IN=http,database for the stable
attribute names, the OTLP endpoint moves to the shared env, and the four
newly instrumented services get the auth header from .env.observability.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

services/audit/worker.py

@@ -1,10 +1,16 @@
 import asyncio
 
+from opentelemetry.instrumentation.sqlalchemy import SQLAlchemyInstrumentor
+
+from common.db import engine
 from common.logging_config import configure_logging
+from common.telemetry import setup_telemetry
 
 from . import consumer
 
 configure_logging("audit")
+setup_telemetry(service_name="audit")
+SQLAlchemyInstrumentor().instrument(engines=[engine.sync_engine])
 
 if __name__ == "__main__":
     asyncio.run(consumer.run())