feat(ops): protect metrics, rate-limit auth, agent secret timing, e2e smoke

Bearer для /metrics (EVOBGP_METRICS_TOKEN); rate limit /v1/auth/config; constant-time agent secret; OTel stub; Playwright smoke; HTTP_PROXY note; checklist обновлён.

Co-authored-by: Cursor <cursoragent@cursor.com>

cmd/evobgp-api/main.go

@@ -52,6 +52,8 @@ func main() {
 	observability.SetBuildInfo(version.Version, version.GitSHA)
 	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
 	defer stop()
+	otelShutdown := observability.StartOTelIfEnabled(ctx)
+	defer func() { _ = otelShutdown(context.Background()) }()
 
 	srv.StartBackground(ctx)
 	startBirdMetricsPoller(ctx)