Phase 2: Replace hub in-memory counters with OTel instruments

[ptone]

Replace BrokerAuthMetrics and GCPTokenMetrics atomic counters with OTel-backed recorders for Cloud Monitoring export.

Changes

• New OTelMetricsRecorder implementing MetricsRecorder interface with OTel instruments
• New OTelGCPTokenMetrics implementing GCPTokenMetricsRecorder interface with OTel instruments
• Both use dual-write pattern: OTel instruments for cloud export + embedded atomic structs for /api/metrics JSON snapshot
• New GCPTokenMetricsRecorder interface to allow polymorphic injection
• SetGCPTokenMetrics() setter on Server
• Wiring in cmd/server_foreground.go within the existing MeterProvider block

Metrics Added

• scion.hub.auth.{attempts,successes,failures} (Counter)
• scion.hub.auth.duration (Histogram, ms)
• scion.hub.registration.count (Counter)
• scion.hub.join.{attempts,failures} (Counter)
• scion.hub.rotation.count (Counter)
• scion.hub.dispatch.{attempts,failures} (Counter)
• scion.hub.brokers.connected (Gauge)
• scion.hub.gcp.token.access.{requests,successes,failures} (Counter)
• scion.hub.gcp.token.identity.{requests,successes,failures} (Counter)
• scion.hub.gcp.token.ratelimit.rejections (Counter)
• scion.hub.gcp.iam.duration (Histogram, ms)

Backward Compatibility

• /api/metrics JSON endpoint returns the same structure
• When GCPProjectID is empty, falls back to existing NewBrokerAuthMetrics() / NewGCPTokenMetrics()
• No call-site changes required