fix(observability): expose recent Sandboxwich event metrics

[haasonsaas]

Summary

Sandboxwich alerting now measures recent lease-expiry, cleanup-failure, and guest-token-issuance events with explicitly windowed gauges. The previous rules applied increase() to durable row-count gauges, so retention changes could look like event bursts. Lease and token windows preserve tenant scoping; cleanup remains operator-global.

Verification

• Local checks:
  • cargo fmt --all -- --check
  • cargo clippy --workspace --all-targets -- -D warnings
  • cargo test --workspace (second run passed; the first run's unrelated worker race passed on exact rerun)
  • New HTTP contract coverage proves fresh and stale rows are separated.
• CI/preflight checks: pending on this PR.
• Runtime or GitOps verification: pending the managed image promotion and deploy configuration rollout.

Scope

This PR changes only Sandboxwich metric production and its regression coverage. It does not mutate production directly. The matching deploy PR changes the alert expressions to consume these new metric names.