feat(monitoring): observability stack + app instrumentation

- /health/ready (DB+MinIO+Casdoor checks, webhook post-deploy gate),
  /metrics via prometheus-fastapi-instrumentator, Sentry/GlitchTip capture,
  X-Request-ID middleware + JSON access logging (PROCUREMENT_LOG_FORMAT)
- server-side analytics (OpenPanel Track API): login, quote lifecycle,
  receipts — fire-and-forget, disabled without env config
- monitoring/ compose project: GlitchTip(+pg), Prometheus(+alerts),
  Grafana(provisioned ERP dashboard), Loki+Promtail, node/postgres
  exporters, cAdvisor — mem-limited (~2.2GB), loopback admin UIs,
  separate from app deploys; erp_shared network for scraping
- frontend: @openpanel/web + @sentry/react (build-arg gated, no-op when
  unset), funnel events (login, wizard steps, quote submitted)
- compose: api healthcheck, observability env wiring, .env.example keys

frontend/Dockerfile

@@ -19,6 +19,15 @@ RUN npm config set registry ${NPM_REGISTRY} && npm ci
 ARG DEV_LOGIN_ENABLED=false
 ENV VITE_ENABLE_DEV_LOGIN=${DEV_LOGIN_ENABLED}
 
+# Observability (Phase 2) — baked into the bundle at build time.
+# Empty values disable the feature (analytics.ts is a no-op then).
+ARG VITE_OPENPANEL_URL=""
+ARG VITE_OPENPANEL_CLIENT_ID=""
+ARG VITE_SENTRY_DSN=""
+ENV VITE_OPENPANEL_URL=${VITE_OPENPANEL_URL} \
+    VITE_OPENPANEL_CLIENT_ID=${VITE_OPENPANEL_CLIENT_ID} \
+    VITE_SENTRY_DSN=${VITE_SENTRY_DSN}
+
 # Source code + build
 COPY . .
 RUN npm run build