Add top-level Observability menu and allow portal access for personal-namespace projects

What does this MR do and why?

This MR does two things:

1. Personal-namespace observability access (Part 3 of 3 in the personal-namespace series) — removes the project.group gate so observability works for groupless projects.
2. New top-level Observability sidebar menu — moves observability items out of Monitor into a dedicated Observability menu that mirrors the group-level sidebar, with all 13 observability items shown conditionally based on GroupO11ySetting.

Sequencing: gitlab-org/embody-team/experimental-observability/documentation#118 → gitlab-org/embody-team/experimental-observability/documentation#121 → this MR (gitlab-org/embody-team/experimental-observability/documentation#119).

Before	After

Permission

Adds read_observability_portal to the project: section of config/authz/roles/developer.yml. ProjectPolicy picks this up via Authz::RolePermissions, giving developer+ users the same threshold groups already have.

New Observability sidebar menu

Creates a new top-level Observability menu in the project sidebar (lib/sidebars/projects/menus/observe_menu.rb) that:

• Is gated behind the observability_sass_features feature flag and read_observability_portal ability
• When GroupO11ySetting is persisted for the project, shows all 13 observability items: Logs, Traces, Metrics, Infrastructure, Services, Dashboards, Alerts, Exceptions, Service map, Messaging queues, External APIs, Notification channels, API keys
• Always shows Setup when the menu renders
• When no setting is persisted, shows only Setup
• Mirrors the group-level ObservabilityMenu pattern but scoped to the project

The existing Monitor menu is cleaned up — Traces, Metrics, and Logs are removed, leaving only Error Tracking, Alerts, Incidents, and Service Desk.

A project-scoped routing helper (app/helpers/routing/projects/observability_helper.rb) is added to auto-dispatch multi-segment observability paths, matching the existing group helper pattern.

Controller

authorize_read_observability! uses a dual-path pattern. show adds a personal-namespace fallback when no setting exists:

• Owner → redirect to project_observability_setup_path (from the previous MR)
• Developer / maintainer → render not_enabled ("ask the project owner")
• Guest → 404 (no read_observability_portal)

Presenter

observability_anchor_data drops the project.group.present? guard. A new observability_setup_path helper returns the group or project setup path as appropriate.

MR acceptance checklist

• Tests added for all new behavior
• read_observability_portal added to project_policy_shared_context.rb
• Changelog trailer included

References

• gitlab-org/embody-team/experimental-observability/documentation#119