Add Prometheus metrics, JSON logs and provider health checks

- GET /metrics (bearer server.metrics_token): build info, users, sessions,
  pending requests, per-model request/token/cost counters, provider_up
- CODECRAFT_LOG_FORMAT=json for one JSON object per log line
- Providers are probed every 5 minutes via their model list; status shown
  in the provider settings with a manual re-check

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/src/api.rs

@@ -121,6 +121,7 @@ pub fn router(app: AppState) -> Router {
         .route("/tools", get(crate::reverse::status))
         .route("/tools/ghidra/install", post(crate::reverse::install_ghidra))
         .route("/providers/{name}/prices", get(provider_prices))
+        .route("/providers/status", get(provider_status).post(recheck_providers))
         .route("/images", get(list_images).post(create_images))
         .route("/images/config", get(images_config))
         .route("/images/{id}", delete(delete_image))
@@ -162,6 +163,7 @@ pub fn router(app: AppState) -> Router {
     Router::new()
         .nest("/api", api)
         .route("/hooks/{id}", post(incoming_webhook))
+        .route("/metrics", get(crate::metrics::metrics))
         .route("/cli/install.sh", get(cli_install_script))
         .route("/cli/download/{target}", get(cli_download))
         .fallback_service(static_files)
@@ -1073,6 +1075,16 @@ async fn health(State(app): State<AppState>) -> Json<Value> {
     Json(json!({"ok": true, "version": crate::update::VERSION, "commit": crate::update::commit(), "sandbox": crate::sandbox::available(), "providers": app.registry().providers.len()}))
 }
 
+async fn provider_status(State(app): State<AppState>) -> Json<Value> {
+    Json(json!(app.health.all()))
+}
+
+async fn recheck_providers(Extension(user): Extension<User>, State(app): State<AppState>) -> ApiResult {
+    require_admin(&user)?;
+    crate::health::check_all(&app).await;
+    Ok(Json(json!(app.health.all())))
+}
+
 // --- budget -------------------------------------------------------------------
 
 /// Budgets concern the whole installation: admins only.