feat(observability): add an opt-in docker-compose observability profile

[tiana-code]

Adds a local telemetry stack as an opt-in Compose profile (E-07, #250).

What

• New observability profile services (all profiles: [observability], pinned image tags): Prometheus, Grafana, Tempo, Loki, an OpenTelemetry collector. Plain docker compose up (and the CI compose smoke) never starts them.
• Prometheus scrapes ledger and payments on their container port (ledger:8080, payments:8080) at /actuator/prometheus.
• ledger and payments export OTLP traces to the collector, which forwards them to Tempo.
• Grafana is pre-provisioned (Prometheus default + Tempo + Loki datasources), anonymous Viewer access, admin password via env-default.
• Config files under deploy/observability/; named volumes for Loki/Tempo.
• Payments /actuator/prometheus is now permitAll (pulled forward so it is scrapable; matches ledger/decision). /v1/payments/** stays scope-protected.
• README documents the profile and the Loki log-shipping follow-up.

Why the default smoke stays green

The backends are profile-gated, so docker compose up --wait (no profile) ignores them. The OTLP endpoint env on the core services targets the collector, but the Boot OTLP exporter is lazy and export failures are non-fatal - the services already defaulted that endpoint to an absent host and prior compose-smoke runs were green, so readiness is unaffected.

Gate chain

• critic: GO (2 notes applied: no depends_on to profiled services, pinned tags).
• security-auditor (opus): PASS - only credential is the env-default Grafana password; payments metrics permit matches convention; profile off by default; §5.3 clean.
• code-reviewer: its OTLP must-fix was a pre-existing/tolerated condition (rejected with evidence; auditor concurred); its two advisories (named volumes, explicit anon Viewer role) were adopted.
• evaluator: PASS (0.885 >= 0.80).
• payments gradle gates green; Docker unavailable locally so the binding check is the CI Compose smoke staying green.

Closes #250