Replace no-op API counter with production metrics adapter

[dotunv]

Summary

Replace the in-memory-only API counter with an adapter-based metrics system that produces observable values in production.

Changes

• MetricsAdapter interface — defines incrementCounter, recordHistogram, and recordAuditEvent
• InMemoryMetricsAdapter — retains the existing map-based implementation; used by default outside production and in tests
• ProductionMetricsAdapter — emits structured JSON logs to stdout with a _metric discriminator for log-aggregation pipelines
• setAdapter/getAdapter — allows tests to swap adapters
• New metric descriptors — auth_failures_total, rate_limits_total, postage_transitions_total (all documented in METRIC_DESCRIPTORS)
• Instrumentation — auth failures (401/403), rate limit hits (429), and postage state transitions now emit metrics

Acceptance criteria

• Counter calls produce observable values in production
• Tests can inspect an in-memory adapter
• Metrics failures do not fail requests
• All emitted metric names are documented in METRIC_DESCRIPTORS

Closes #1509