feat(observability): Prometheus metrics endpoint

[CharmingGroot]

Problem

There is no machine-readable operational signal: verdict rates, kernel drop counts, DNS refresh health, HITL queue depth. Log scraping (stderr JSONL) is the only integration point.

Proposal

• /metrics (Prometheus text format) on pasu-daemon (and optionally pasu-proxy).
• Counters: verdicts by layer/action/rule, kernel drops (depends on the RingBuf work in feat(egress): emit kernel drop events to the audit log #67), DNS refresh successes/failures, approvals granted/denied/timed out.
• Off by default; enable with --metrics <addr>.

Notes

Keep the metrics registry in the app binaries; library crates stay free of the dependency (crate-boundary rule in CLAUDE.md §1).