Expose Prometheus metrics on a separate port

Metrics are served on METRICS_PORT (default 2112, "off" to disable), never on
the public port. Besides the Go runtime and process metrics this adds:

- http_requests_total and http_request_duration_seconds per route pattern,
  from an Echo middleware.
- musicserver_songs_requested_total and musicserver_songs_played_total by
  pick mode (random, low, classic). The mode is now stored with each queued
  song (migration 000006, not released yet).
- Library size, sync duration, last successful sync, broken songs from the
  last full sync, and the database connection pool.

Refs #35, #36, #37

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/routes.go

@@ -6,6 +6,7 @@ import (
 
 	"music-server/cmd/web"
 	"music-server/internal/logging"
+	"music-server/internal/metrics"
 	"music-server/internal/server/middleware"
 
 	"github.com/a-h/templ"
@@ -39,6 +40,8 @@ func (s *Server) routes() (*echo.Echo, huma.API) {
 	}
 
 	e.Use(logging.RequestLogger())
+	// Outside Recover, so requests that panic are counted with status 500.
+	e.Use(metrics.Middleware())
 	e.Use(echoMiddleware.Recover())
 	// Without allowed origins no CORS headers are sent, so only same-origin browser requests work.
 	// The API uses Bearer tokens, not cookies, so credentials are not allowed.