feat: serve Prometheus metrics and split health into live and ready

- `/api/metrics` in Prometheus text format, off until `METRICS_TOKEN`
  or `METRICS_TOKEN_FILE` is set (404 before, 401 without the bearer
  token): requests per route group with status class and latency,
  sign-in outcomes, calls to Stalwart, WOPI, translation, the plugin
  proxy and OAuth, browser errors, errors today, process memory,
  event-loop lag, uptime and build info. Labels come from fixed lists.
  Each replica serves its own.
- `/api/health/live` answers while the process runs;
  `/api/health/ready` checks the config, the shared store, writable
  data dirs and Stalwart's session resource. `/api/health` and
  `/api/ready` are unchanged.
- the Docker image gets a HEALTHCHECK on the live endpoint
- adds prom-client, and the OpenTelemetry packages the tracing step
  loads on demand

scripts/healthcheck.mjs

@@ -0,0 +1,15 @@
+// Docker HEALTHCHECK: exit 0 when /api/health/live answers 200 within 4 s.
+// Liveness only, so a Stalwart outage never marks the container unhealthy.
+// The base path is baked in at build time (BULWARK_BASE_PATH in the image).
+// https://bulwarkmail.org/docs/admin/monitoring#health
+const port = process.env.PORT || '3000';
+const listen = process.env.HOSTNAME;
+const host = !listen || listen === '0.0.0.0' || listen === '::' ? '127.0.0.1' : listen.includes(':') ? `[${listen}]` : listen;
+const base = (process.env.BULWARK_BASE_PATH || '').replace(/\/+$/, '');
+
+try {
+  const res = await fetch(`http://${host}:${port}${base}/api/health/live`, { signal: AbortSignal.timeout(4000) });
+  process.exit(res.ok ? 0 : 1);
+} catch {
+  process.exit(1);
+}