feat(server): /metrics 可观测与日志上下文（F22）

- 新增 Prometheus 指标端点 /metrics（HTTP + DB + 作业统计）
- request.log 绑定 requestId/actorId，避免日志难追踪
- cron/pg-boss 作业增加 metrics 计数（runs/processed）
- 更新 env/runbook/README 与 v3 CSV 状态推进

server/src/app.js

@@ -30,6 +30,7 @@ const approvalRulesRoutes = require("./routes/approvalRules");
 const notificationsRoutes = require("./routes/notifications");
 const exportsRoutes = require("./routes/exports");
 const { startJobs } = require("./jobs/jobSystem");
+const { initMetrics } = require("./observability");
 const { AppError } = require("./utils/AppError");
 
 async function buildApp() {
@@ -112,6 +113,9 @@ async function buildApp() {
 
   app.addHook("onRequest", async (request, reply) => {
     reply.header("x-request-id", request.id);
+    if (request.log && typeof request.log.child === "function") {
+      request.log = request.log.child({ requestId: request.id });
+    }
   });
 
   app.setNotFoundHandler(async (request, reply) => {
@@ -189,6 +193,23 @@ async function buildApp() {
     }
   });
 
+  if (config.metricsEnabled) {
+    initMetrics(app);
+    app.get("/metrics", async (request, reply) => {
+      try {
+        await app.prisma.$queryRaw`SELECT 1`;
+        app.metrics.dbReady.set(1);
+      } catch {
+        app.metrics.dbReady.set(0);
+      }
+
+      const payload = await app.metrics.registry.metrics();
+      reply.header("content-type", app.metrics.registry.contentType);
+      return reply.send(payload);
+    });
+    app.log.info("Metrics endpoint enabled at /metrics");
+  }
+
   await app.register(authRoutes, { prefix: "/api/auth" });
   await app.register(meRoutes, { prefix: "/api" });
   await app.register(reimbursementRoutes, { prefix: "/api" });