M39: harden application and acceptance gates

backend/app/core/observability.py

@@ -74,10 +74,19 @@ def correlation_id_for(request: Request) -> str:
         return str(uuid.uuid4())
 
 
+UNMATCHED_ROUTE_LABEL = "<unmatched>"
+
+
 def route_label(request: Request) -> str:
+    """Return the route *template* for metrics labels.
+
+    Unmatched paths (404 probes, scanners) must not become their own label value:
+    every distinct URL would otherwise create a new Prometheus time series and the
+    metric cardinality would grow without bound.
+    """
     route = request.scope.get("route")
     path = getattr(route, "path", None)
-    return str(path or request.url.path)
+    return str(path) if path else UNMATCHED_ROUTE_LABEL
 
 
 def request_started() -> float: