feat(ops): Micrometer + Prometheus metrics for evaluation and admin APIs

[trinhvandat]

Context (P1 — operability + product value)

No metrics exist. Evaluation rate/latency per environment is both an ops signal and product value (dead-flag detection feeds on it).

Scope

• micrometer-registry-prometheus; expose /actuator/prometheus (behind network policy or basic allowlist — not public)
• Custom metrics: ff_evaluations_total{environment}, evaluation latency timer, ff_flag_changes_total, auth failure counter
• Default JVM/HTTP server metrics enabled
• Depends on: Actuator issue

Acceptance criteria

• /actuator/prometheus scrapes successfully and includes the custom counters
• Counter tags bounded (environment id, not free-form strings)
• Not accessible via public SDK/admin chains without authorization