feat(infra): auto-discovery Prometheus + Traefik metrics

- Prometheus: add docker_sd_configs for auto-discovery via labels
- Prometheus: mount Docker socket for Docker SD
- Traefik: enable --metrics.prometheus with entrypoint/service labels
- Traefik: add prometheus.io/scrape=true label
- Observability: mount Docker socket for Prometheus container
- Bump hub submodule (Traefik metrics queries + sparkline charts)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

infra/compose/observability.yml

@@ -55,6 +55,7 @@ services:
     volumes:
       - ../../infra/otel/prometheus.yml:/etc/prometheus/prometheus.yml:ro
       - /prometheus
+      - /var/run/docker.sock:/var/run/docker.sock:ro
 
   # ── Node Exporter (Host Metrics: CPU, RAM, Disk) ──
   node-exporter:

infra/compose/traefik.yml

@@ -50,6 +50,9 @@ services:
       - '--experimental.plugins.blockpath.moduleName=github.com/traefik/plugin-blockpath'
       - '--experimental.plugins.blockpath.version=v0.2.1'
       - '--ping=true'
+      - '--metrics.prometheus=true'
+      - '--metrics.prometheus.addEntryPointsLabels=true'
+      - '--metrics.prometheus.addServicesLabels=true'
       - '--tracing.otlp=true'
       - '--tracing.otlp.http=true'
       - '--tracing.otlp.http.endpoint=http://otel-collector:4318'
@@ -77,6 +80,8 @@ services:
       - 'traefik.http.routers.traefik.entrypoints=websecure'
       - 'traefik.http.routers.traefik.tls=true'
       - 'traefik.http.routers.traefik.middlewares=admin-chain@file'
+      - 'prometheus.io/scrape=true'
+      - 'prometheus.io/port=8080'
 
 networks:
   app-shared-net:

infra/otel/prometheus.yml

@@ -3,6 +3,32 @@ global:
   evaluation_interval: 15s
 
 scrape_configs:
+  # ── Docker SD: containers with prometheus.io/scrape=true are auto-discovered ──
+  - job_name: 'docker'
+    docker_sd_configs:
+      - host: unix:///var/run/docker.sock
+        refresh_interval: 15s
+        filters:
+          - name: label
+            values:
+              - prometheus.io/scrape=true
+    relabel_configs:
+      - source_labels: [__meta_docker_container_name]
+        target_label: container
+        regex: '/(.*)'
+        replacement: '${1}'
+      - source_labels: [__meta_docker_container_label_prometheus_io_port]
+        regex: '(.+)'
+        target_label: __metrics_path__
+        replacement: '/metrics'
+      - source_labels: [__meta_docker_container_label_prometheus_io_path]
+        regex: '(.+)'
+        target_label: __metrics_path__
+        replacement: '${1}'
+      - source_labels: [__address__]
+        target_label: instance
+
+  # ── OTel Collector ──
   - job_name: 'otel-collector'
     scrape_interval: 10s
     metrics_path: /metrics
@@ -11,6 +37,7 @@ scrape_configs:
         labels:
           service: otel-collector
 
+  # ── Node Exporter ──
   - job_name: 'node'
     scrape_interval: 15s
     static_configs: