feat(metrics): Prometheus /actuator/prometheus with kview_* series

[ritikbansod]

Implements F6 — Prometheus metrics from the deep analysis (the last of the low-effort roadmap items): Kview becomes part of the observability stack instead of only a viewer. Stacked on #5 — merge #1 → #2 → #3 → #4 → #5 → this.

Series exposed on /actuator/prometheus

Series	Tags	Meaning
kview_cluster_topics / kview_cluster_partitions	cluster	counts from the cluster overview
kview_cluster_under_replicated_partitions / kview_cluster_offline_partitions	cluster	replication health
kview_cluster_consumer_groups	cluster	group count
kview_cluster_reachable	cluster	1 when the last sample reached the cluster
kview_consumer_group_lag	cluster, group	total lag per consumer group
kview_messages_produced_total	cluster, topic	counter incremented by the produce path

Design

A 15-second in-process sampler (KVIEW_METRICS_INTERVAL_MS) computes the snapshots from the same services the dashboard uses and keeps them in memory — a scrape never blocks on broker calls. Gauges read the sampled values; series appear and disappear with the clusters and consumer groups they describe (stale meters are unregistered). Unreachable clusters report kview_cluster_reachable 0 with zeroed series.

The endpoint follows the actuator auth rules from #2: public while kview.auth.mode=none (loopback scraping works immediately), any-role-required once authentication is on — the scraper gets a read-only token or the path is permitted at the proxy (documented in SECURITY.md).

Verification

• MetricsEndpointTest: produces through the wrapper, runs a sample pass, asserts the kview_* series with cluster="default" appear on the endpoint, and that it is public in the default mode. One Boot gotcha solved along the way: Spring Boot test contexts disable metrics export by default (a test property source sets management.defaults.metrics.export.enabled=false); @AutoConfigureObservability re-enables it.
• Full suite: 58/58 green.
• Not covered: Grafana dashboard JSON (series are standard and self-describing); scrape over TLS/proxy setups.