telemetry: add bounded self-metrics, /metrics endpoint, and ServiceMonitor

[hivecommons-hive]

Summary

Closes #23055 — the console backend already carries prometheus/client_golang as a direct dependency (used in pkg/gpu/scraper.go to scrape external clusters) but never exposed its own metrics.

Changes

• New pkg/api/metrics package registering two bounded-label Prometheus collectors:
  • console_http_requests_total{method, route, status}
  • console_http_request_duration_seconds{method, route}
  • route is always the registered Fiber route pattern (e.g. /api/clusters/:name), never the raw request path, so cardinality stays fixed regardless of request input (unmatched/404 requests are bucketed under a single unmatched label).
• Mounted GET /metrics in pkg/api/routes_health.go alongside the existing /healthz//health probes, and wired the recording middleware in pkg/api/middleware_setup.go.
• Added an opt-in, disabled-by-default ServiceMonitor Helm template (deploy/helm/kubestellar-console/templates/servicemonitor.yaml) plus a metrics.serviceMonitor values.yaml knob, for operators who already run Prometheus Operator.
• Unit test (pkg/api/metrics/metrics_test.go) asserting the recorded label is the bounded route pattern and that raw path values never leak into metric labels.

Why this is safe

• No external data flow: metrics are only ever pulled by an operator-controlled Prometheus scraping this pod's /metrics. Nothing is pushed off-box, and no exporter/collector config is added.
• No backend is confirmed for this project per current audit policy, so this PR is scoped to self-metrics + opt-in scrape config only — no dashboards or alert rules are included.
• Labels are bounded (method, registered route, status) — verified by the added test.

Testing

• go build ./pkg/api/...
• go test ./pkg/api/... (full package, including the new pkg/api/metrics test) — all pass
• gofmt -l clean on all new/modified files

— hive: agent=telemetry backend=copilot model=claude-sonnet-4-6

[hivecommons-hive]

Important

Held for human sign-off on the direction, not on the code.

This PR's only tracked rationale is #23055, which the hive filed itself — issue #23055 was filed by kubestellar-hive[bot] and no human has acknowledged it. An agent-filed issue does not, on its own, establish that anyone agreed to the direction (hivecommons/hive#5117).

The change may well be right; nothing here is a review of it. To release the hold, acknowledge the direction on that issue — comment on it, assign yourself, or add the approved-direction label — and remove the hold label here.

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign eeshaansa for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[netlify]

✅ Deploy Preview for kubestellarconsole canceled.

Name	Link
🔨 Latest commit	e1a88ad
🔍 Latest deploy log	https://app.netlify.com/projects/kubestellarconsole/deploys/6a998ee353c0da000844f540

[github-actions]

👋 Hey @kubestellar-hive[bot] — thanks for opening this PR!

🤖 This project is developed exclusively using AI coding assistants.

Please do not attempt to code anything for this project manually.
All contributions should be authored using an AI coding tool such as:

• Claude Code (Opus 4.5 / 4.6) — recommended
• GitHub Copilot
• Cursor
• Other AI coding assistants

This ensures consistency in code style, architecture patterns, test coverage,
and commit quality across the entire codebase.

---

This is an automated message.

[github-actions]

Thank you for your contribution! Your PR has been merged.

Check out what's new:

• KubeStellar Console — Live multi-cluster dashboard
• Marketplace — Community extensions
• Knowledge Base — Troubleshooting and how-tos

Stay connected: Slack #kubestellar-dev | Multi-Cluster Survey

[github-actions]

Post-merge build verification passed ✅

Both Go and frontend builds compiled successfully against merge commit 53bb7e0b2b3d913ed96416103a27c76be04894e3.

[github-actions]

✅ Post-Merge Verification: passed

Commit: 53bb7e0b2b3d913ed96416103a27c76be04894e3
Specs run: smoke.spec.ts
Report: https://github.com/kubestellar/console/actions/runs/33779080031