feat: metrics endpoint for monitoring

[Code-Paragon]

Summary

This PR implements a standard Prometheus text-format metrics endpoint to provide comprehensive API observability and Node.js system monitoring.

Related Issue

Closes #59

Changes Implemented

• Prometheus Client: Integrated prom-client to expose standard Node.js system metrics (CPU, Memory, Event Loop Lag).
• Custom Instrumentation: Created global middleware to track http_requests_total (Counter) and http_request_duration_seconds (Histogram).
• Cardinality & PII Protection: The middleware dynamically extracts the Express route pattern (req.route.path instead of req.path) to ensure dynamic IDs (e.g., /api/users/123) do not leak PII or cause Prometheus cardinality explosions. Fallback regex is included for unmatched 404 routes.
• Production Security: The /api/metrics endpoint requires a Bearer token matching the METRICS_API_KEY environment variable when NODE_ENV=production.
• Documentation: Added observability configuration details to the README.

Verification

Verified locally. curl http://localhost:3000/api/metrics successfully returns the Prometheus payload with correctly labeled route traffic.

[greatest0fallt1me]

please resolve the conflicts

[greatest0fallt1me]

@Code-Paragon

[Code-Paragon]

@greatest0fallt1me I have a few merge conflicts here, mostly in the package.json and lockfile. My laptop is currently dead and I'm waiting for power/charge to get back online.

I’ll resolve these as soon as I’m back at my desk to ensure the lockfile stays perfectly in sync and the JSON remains valid. Thanks for your patience!"

[Code-Paragon]

@greatest0fallt1me I have successfully resolved the merge conflicts! The metrics
Middleware and Prometheus endpoints are now perfectly integrated into the new app.ts / index.ts architecture.

Please note: The CI build will likely fail because the recent commits to main introduced several strict TypeScript errors in the src/webhooks and src/events directories (missing .js extensions for ESM imports, and an err.message unknown type). I left those files untouched so as not to step on your toes, but my metrics code is resolved and ready to go

[Code-Paragon]

@greatest0fallt1me I have cleanly resolved the merge conflicts here! I manually consolidated the package.json dependencies and completely regenerated the package-lock.json to ensure there are no corrupted dependency trees.

Just a heads-up regarding the failing CI check: it is failing for the exact same reason as the Metrics PR. The CI pipeline is catching the TypeScript compilation errors (missing .js extensions and implicit any types) present in the src/webhooks and src/events directories that currently exist on main.

The isolated repository test suite itself is 100% intact and ready to go once the main branch stabilizes. Let me know if you need any adjustments to the repo logic in the meantime!