feat: emit reconciliation drift as OpenMetrics

[Horlarmmy]

Summary

Adds a /metrics/reconciliation endpoint that serves reconciliation drift
metrics in OpenMetrics text format (v1.0.0), guarded by the existing
METRICS_BEARER_TOKEN middleware.

Changes

src/lib/metrics.ts

• Added metricCreated map to track first-observation timestamps per metric key
• Added exportOpenMetrics(namePrefix?) method producing OpenMetrics-compliant
  output (HELP/TYPE lines, _created epoch timestamps, histogram bucket
  expansion, # EOF terminator)

src/services/reconciliationScheduler.ts

• Registered 3 new metric families in the scheduled tick:

  Metric	Type	Labels	Description
  reconciliation_drift_amount	gauge	{offering_id}	Monetary drift amount from latest run
  reconciliation_last_run_timestamp	gauge	{offering_id}	Unix epoch seconds of last completed run
  reconciliation_errors_total	counter	{offering_id}	Cumulative failed-run count

src/routes/reconciliationRoutes.ts

• Added createReconciliationMetricsHandler() — filters MetricsCollector to
  reconciliation_* metrics and returns them with content-type
  application/openmetrics-text; version=1.0.0; charset=utf-8

src/app.ts

• Wired GET /metrics/reconciliation behind createMetricsAuthMiddleware()

docs/reconciliation-metrics.md

• New doc with metric reference, example output, security assumptions, and
  alerting PromQL snippets

Security

• Endpoint reuses the same METRICS_TOKEN bearer auth (constant-time
  comparison via crypto.timingSafeEqual)
• Metric labels sanitized by existing PII filter (email, phone, IP, UUID
  patterns redacted)
• Cardinality bounded to 50 individually-labelled offerings (configurable);
  overflow aggregated under offering_id="overflow"

Testing

• 129 tests pass across 3 test suites (metrics, reconciliation routes,
  reconciliation scheduler)
• Coverage includes: auth guard, prefix filtering, OpenMetrics format
  compliance (_created, HELP, TYPE, # EOF), empty metrics, error
  propagation, cardinality overflow for all new metric families

Closes #479

[drips-wave]

@Horlarmmy Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits