Instrument session and grant metrics

[haasonsaas]

Summary

• add ASB domain metrics for sessions, grants, and approvals under internal/app
• wire the app metrics into bootstrap so they register on the existing /metrics endpoint
• cover create, approval, revoke, and expiry paths with Prometheus-backed tests

Testing

• go test ./internal/app
• go test ./internal/bootstrap ./cmd/asb-api ./internal/api/httpapi
• go test ./...
• git diff --check

[cursor]

PR Summary

Medium Risk
Touches core session/grant state transitions and cleanup paths; while behavior changes are limited to metrics side effects, incorrect transition accounting could skew observability or cause Prometheus registration conflicts.

Overview
Adds Prometheus domain metrics for ASB session/grant/approval lifecycles, including sessions_active (by tenant), sessions_total and grants_total (by outcome), plus histograms for grant_ttl_seconds and approval_wait_seconds.

Wires metrics into the app Service and lifecycle paths (create, issue, approve/deny/expire, revoke, cleanup expiry) so transitions increment counters and maintain the active-session gauge, and registers the collectors during bootstrap so they appear on the existing /metrics endpoint. Includes Prometheus-backed tests covering create+issue, approval flow, revoke, and cleanup expiry.

^{Reviewed by Cursor Bugbot for commit ff8b9a2. Bugbot is set up for automated code reviews on this repo. Configure here.}