feat: report traces to SigNoz via @agentage/observability

[vreshch]

What changed

Instruments diffractwd.com with @agentage/observability, mirroring vreshch.com's already-merged setup (vreshch/vreshch.com#169):

• src/instrumentation.ts registers the OTEL SDK via @agentage/observability/next (inert unless the OTEL env pair is set).
• package.json adds @agentage/observability and @vercel/otel.
• Traces export to SigNoz over the WG mesh at http://172.31.0.1:4318, service name diffractwd-web, service.namespace=side, 20% head sampling (OTEL_TRACES_SAMPLER_ARG=0.2). Metrics/logs exporters are none — traces only.

Deviation from the vreshch.com pattern (important)

diffractwd.com previously had no runtime-env delivery mechanism at all — no .env written to the server, no env_file in docker-compose.yml, zero secrets ever passed to the container. vreshch.com already had this (for RESEND_API_KEY/contact-form vars) and this PR only appended the OTEL lines to its existing heredoc.

This PR therefore adds the mechanism itself, net-new, structurally identical to vreshch.com's:

• New .github/workflows/deploy.yml step 🔑 Write runtime env on server, placed after the compose/script scp step and immediately before 🚀 Deploy application (which runs docker stack deploy). It install -m 600s the 8 OTEL_* lines to /opt/diffractwd-com/.env via the same ssh -i ~/.ssh/deploy_key root@${{ secrets.SERVER_HOST }} invocation this workflow already uses elsewhere (no new secret names introduced).
• docker-compose.yml's web service now has env_file: [.env], resolved relative to /opt/diffractwd-com where the stack is deployed from.

Consequence: the deploy now requires /opt/diffractwd-com/.env to exist before docker stack deploy runs — that's exactly what the new step guarantees by always writing the file first, every deploy. If that step were ever skipped or failed silently, docker compose's env_file resolution would fail and abort the stack deploy, so the step is unconditional (not gated on secret presence).

SIGNOZ_INGEST_TOKEN is already set as a repo secret on vreshch/diffractwd.com (confirmed by the coordinator, not independently verified here per no-secrets-access constraint).

Verify (local, in worktree)

npm run verify (tsc --noEmit && next lint && next build && vitest run) — all green:

• ESLint: no warnings/errors
• Build: compiled successfully, 14 routes generated
• Tests: 4 files / 31 tests passed

No deploy, no merge, no GitHub secrets touched — worktree-only change per standing policy.

[github-actions]

🎉 PR Validation ✅ PASSED

Commit: a1504576655ab78ac7db27fb293c62a5f723489f
Branch: feature/obs-kit

Checks:

• ✅ Dependencies installed
• ✅ Linting passed
• ✅ Format check passed
• ✅ Build successful
• ✅ Docker build
• ✅ E2E tests

Visual Changes: 5 of 20 screenshots changed

📸 downloads dark desktop — 100% changed

📸 downloads dark mobile — 100% changed

📸 downloads light desktop — 100% changed

📸 downloads light mobile — 100% changed

📸 home dark mobile — 1.222% changed

Before	After	Diff

Ready to merge! ✨

---

🔗 View workflow run
⏰ Generated at: 2026-08-08T02:21:07.613Z