Instrument SQLAlchemy in every service with a database

sanctions, notifier, ledger, insights and audit now call setup_telemetry
and instrument their engines with one SQLAlchemyInstrumentor call per
process (a second instrument() call is ignored, leaving that engine with
connect spans only). ledger and insights pass both their normal and
starved engines. The FastAPI services also get the server span, with the
same /healthz and receive/send exclusions as sanctions.

Compose: OTEL_SEMCONV_STABILITY_OPT_IN=http,database for the stable
attribute names, the OTLP endpoint moves to the shared env, and the four
newly instrumented services get the auth header from .env.observability.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

services/insights/app.py

@@ -4,22 +4,35 @@ import time
 
 from fastapi import FastAPI, Request
 from fastapi.responses import JSONResponse
+from opentelemetry.instrumentation.fastapi import FastAPIInstrumentor
+from opentelemetry.instrumentation.sqlalchemy import SQLAlchemyInstrumentor
 
 from common.chaos_flags import flags_fingerprint
 from common.logging_config import configure_logging
 from common.redis_client import redis_client
 from common.settings import settings
+from common.telemetry import setup_telemetry
 
 import sqlalchemy as sa
 
 from . import chaos
 from .analytics import account_exists, compute_summary
-from .db import NormalSession, engine, session_factory
+from .db import NormalSession, engine, normal_engine, session_factory, starved_engine
 
 SERVICE_NAME = "insights"
 logger = configure_logging(SERVICE_NAME)
+setup_telemetry(service_name=SERVICE_NAME)
 app = FastAPI(title=SERVICE_NAME)
 
+FastAPIInstrumentor.instrument_app(
+    app,
+    excluded_urls="/healthz",
+    exclude_spans=["receive", "send"],
+)
+SQLAlchemyInstrumentor().instrument(
+    engines=[normal_engine.sync_engine, starved_engine.sync_engine]
+)
+
 # Cache-stampede protection for the Redis-cached branch below: a burst of
 # concurrent requests for the same not-yet-cached (account, flags) key would
 # otherwise all pay the full computation cost at once instead of one paying