feat(infra): auto-discovery Prometheus + Traefik metrics

- Prometheus: add docker_sd_configs for auto-discovery via labels
- Prometheus: mount Docker socket for Docker SD
- Traefik: enable --metrics.prometheus with entrypoint/service labels
- Traefik: add prometheus.io/scrape=true label
- Observability: mount Docker socket for Prometheus container
- Bump hub submodule (Traefik metrics queries + sparkline charts)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

infra/compose/observability.yml

@@ -55,6 +55,7 @@ services:
     volumes:
       - ../../infra/otel/prometheus.yml:/etc/prometheus/prometheus.yml:ro
       - /prometheus
+      - /var/run/docker.sock:/var/run/docker.sock:ro
 
   # ── Node Exporter (Host Metrics: CPU, RAM, Disk) ──
   node-exporter:

infra/compose/traefik.yml

@@ -50,6 +50,9 @@ services:
       - '--experimental.plugins.blockpath.moduleName=github.com/traefik/plugin-blockpath'
       - '--experimental.plugins.blockpath.version=v0.2.1'
       - '--ping=true'
+      - '--metrics.prometheus=true'
+      - '--metrics.prometheus.addEntryPointsLabels=true'
+      - '--metrics.prometheus.addServicesLabels=true'
       - '--tracing.otlp=true'
       - '--tracing.otlp.http=true'
       - '--tracing.otlp.http.endpoint=http://otel-collector:4318'
@@ -77,6 +80,8 @@ services:
       - 'traefik.http.routers.traefik.entrypoints=websecure'
       - 'traefik.http.routers.traefik.tls=true'
       - 'traefik.http.routers.traefik.middlewares=admin-chain@file'
+      - 'prometheus.io/scrape=true'
+      - 'prometheus.io/port=8080'
 
 networks:
   app-shared-net: