feat: expose retained account quota metrics

[korkin25]

Operators can inspect retained quota evidence in the admin dialog, but /metrics currently has no account inventory, membership or quota gauges. This adds 36 native gauge families for every non-deleted enrolled identity, including inactive, never-successful and unassigned accounts, plus each retained source's reported usage, reset time, freshness and routing-selection provenance.

Collection runs after the existing metrics authorization check. It reads only the required metadata in three set-based queries inside one REPEATABLE READ, READ ONLY transaction, bounded by a five-second total read deadline including connection-pool checkout. Timeout or caller termination cancels the owned collector and queued/active SQL. Collection failures preserve operational metrics and expose collector failure without cached or fabricated account data. Scrapes do not load account secrets, refresh OAuth, poll providers, enqueue work, call models or switch accounts.

Unknown measurements remain unknown, elapsed/stale evidence remains visible, and reported remaining percentages do not establish actual provider capacity. Labels use internal UUIDs, fixed enums and opaque hashes, with per-account cardinality limits and no email, raw provider identifiers or error payloads. The current admin dialog, selected percentage/countdown, routing behavior and default routing telemetry remain unchanged; only metrics evaluation suppresses routing-decision telemetry.

The shared group digest exactly matches the current upstream evidence dialog. This 36-family contract omits the earlier experimental fork's automatic source/reset conflict gauges. Its meter digest differs from that fork's prefixed digest, so the monitoring documentation describes explicit dashboard/history migration rather than treating those time series as a drop-in replacement. There are no schema, dependency, CI, runtime-version or release-packaging changes.

Validation on Elixir 1.20.4 / OTP 29 and synthetic PostgreSQL 18:

• Formatting, warnings-as-errors compilation, xref, strict Credo and assets: passed.
• Focused source/UI/HTTP/SQL tests: 103 passed, including real pool contention, active SQL cancellation, caller death and malformed reconciliation JSON.
• Standard make test-fast N=4: 8,449 passed, 59 standard unix_integration exclusions; all four partitions passed.
• Comparison against the original upstream dialog module: 720 assertions across 180 fixtures passed.
• Independent Prometheus parsing: 36 gauge families, finite unique samples, unknown-value omission, and 5,139 samples at the documented maximum one-account boundary.