feat(api-server): add OpenTelemetry instrumentation for HTTP and gRPC

[JuanmaBM]

Summary

• Add OTel tracing and metrics to the API server via a new plugins/otel plugin that registers HTTP middleware (otelhttp) and gRPC interceptors through the framework's pre-auth hooks
• Instrumentation is opt-in: when OTEL_EXPORTER_OTLP_ENDPOINT is unset the plugin is a no-op with zero overhead
• Add Jaeger all-in-one deployment for Kind clusters via KIND_JAEGER=true
• Add spec: specs/platform/api-server-observability.spec.md

What's included

Component	Change
plugins/otel/plugin.go	OTel SDK init (TracerProvider + MeterProvider), HTTP middleware, gRPC unary/streaming interceptors, W3C Trace Context propagation, graceful shutdown
cmd/hypershell/main.go	Side-effect import for the OTel plugin
deploy/kind/jaeger.yaml	Jaeger all-in-one Deployment + Service + HTTPRoute
scripts/kind/up.sh	Conditional Jaeger deployment and API server env var patch when KIND_JAEGER=true
specs/platform/api-server-observability.spec.md	Full spec with 6 requirements and scenarios
specs/index.spec.md	Registry entry
specs/platform/local-development.spec.md	KIND_JAEGER and JAEGER_VERSION env vars

Environment Variables

Var	Default	Description
OTEL_EXPORTER_OTLP_ENDPOINT	(unset)	OTLP collector endpoint; enables instrumentation when set
OTEL_TRACES_SAMPLER_ARG	1.0	Trace sampling ratio (0.0–1.0)
OTEL_SERVICE_NAME	hypershell-api-server	Service name in spans/metrics
KIND_JAEGER	(unset)	Set to true to deploy Jaeger in Kind
JAEGER_VERSION	2.6	Jaeger image tag

Test plan

• go build ./... and go vet ./... pass (verified)
• Verify Jaeger deploys in Kind with KIND_JAEGER=true make kind-up
• Send HTTP requests and confirm traces appear in Jaeger UI
• Verify gRPC Watch streams produce spans
• Confirm no telemetry overhead when OTEL_EXPORTER_OTLP_ENDPOINT is unset
• Verify no sensitive data (auth headers, tokens) in span attributes

🤖 Generated with Claude Code