fix(webui): /metrics is a console page, not an API 404 — drop it from apiPrefixes

The console catch-all 404'd /metrics because it was in apiPrefixes (the Prometheus
scrape-path convention). But the real Prometheus surface is on the SEPARATE ops
listener (:9090, healthMux); on the product API (:8000) /metrics is the console
MetricsModule page. Drop /metrics from apiPrefixes so it falls through to the SPA
shell. One surface per port: :8000 product+SPA, :9090 ops. (ServiceMonitor repointed
to the ops port in the same change.)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

webui.go

@@ -35,7 +35,12 @@ var consoleFS embed.FS
 // /v1/does-not-exist) must return a real 404 from the API namespace — not the
 // SPA shell — so clients never receive HTML where they expect JSON. Every other
 // path is a client-side console route and falls back to index.html.
-var apiPrefixes = []string{"/v1/", "/zap", "/healthz", "/readyz", "/metrics"}
+// NOTE: "/metrics" is intentionally NOT here. The Prometheus scrape surface lives
+// on the SEPARATE ops listener (:9090, healthMux) — see serve.go. On the public
+// product API (:8000) "/metrics" is a CONSOLE product page (the MetricsModule), so
+// it must fall through to the SPA shell, not 404. One surface per port: :8000 =
+// product API + SPA, :9090 = ops (health + Prometheus /metrics).
+var apiPrefixes = []string{"/v1/", "/zap", "/healthz", "/readyz"}
 
 // mountConsole registers the embedded console at the web root as the app's
 // terminal handler. It is called LAST in Serve — after every /v1 subsystem