Instrument SQLAlchemy in every service with a database

sanctions, notifier, ledger, insights and audit now call setup_telemetry
and instrument their engines with one SQLAlchemyInstrumentor call per
process (a second instrument() call is ignored, leaving that engine with
connect spans only). ledger and insights pass both their normal and
starved engines. The FastAPI services also get the server span, with the
same /healthz and receive/send exclusions as sanctions.

Compose: OTEL_SEMCONV_STABILITY_OPT_IN=http,database for the stable
attribute names, the OTLP endpoint moves to the shared env, and the four
newly instrumented services get the auth header from .env.observability.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

services/notifier/app.py

@@ -4,15 +4,19 @@ import asyncio
 
 from fastapi import FastAPI, Request
 from fastapi.responses import JSONResponse
+from opentelemetry.instrumentation.fastapi import FastAPIInstrumentor
+from opentelemetry.instrumentation.sqlalchemy import SQLAlchemyInstrumentor
 
 from common.db import engine
 from common.logging_config import configure_logging
 from common.redis_client import redis_client
+from common.telemetry import setup_telemetry
 
 from . import consumer
 
 SERVICE_NAME = "notifier"
 logger = configure_logging(SERVICE_NAME)
+setup_telemetry(service_name=SERVICE_NAME)
 
 
 @asynccontextmanager
@@ -24,6 +28,13 @@ async def lifespan(app: FastAPI):
 
 app = FastAPI(title=SERVICE_NAME, lifespan=lifespan)
 
+FastAPIInstrumentor.instrument_app(
+    app,
+    excluded_urls="/healthz",
+    exclude_spans=["receive", "send"],
+)
+SQLAlchemyInstrumentor().instrument(engines=[engine.sync_engine])
+
 
 @app.get("/")
 async def root():