M22: implement operational observability

PROJECT_STATE.md

@@ -2520,3 +2520,20 @@ evidence yet."
 - Evidence: focused authentication **13 passed with zero warnings**; frontend production
   build passed; ruff clean. Exact next action: implement structured request logging,
   correlation, metrics, dashboards and alerts.
+
+## M22 — operational observability (2026-08-10)
+
+- Added UUID request correlation propagated through response headers, structured API
+  errors and machine-readable JSON request logs. Logs include UTC time, route, method,
+  status, latency and client IP; Docker rotates bounded 10 MB files.
+- Added Prometheus metrics for request rate/status, duration buckets, in-flight requests,
+  database readiness and persisted outbox state separated into real and synthetic
+  scenarios. `/metrics` supports constant-time Bearer protection if exposed beyond the
+  private Compose network.
+- Added an optional pinned Prometheus/Grafana Compose profile, provisioned datasource,
+  six-panel operational dashboard and six validated alert rules. Real failures and
+  backlogs alert; the deliberate demo retry does not.
+- Evidence: focused observability **5 passed without warnings**; ruff/mypy clean;
+  Prometheus `promtool` accepted the scrape config and all six rules; merged Compose and
+  Grafana dashboard JSON validate. Exact next action: automate verified backups,
+  retention and restore-readiness checks.