npm hosted Step 22: observability hooks

Structured LabKit v2 logging fields (namespace_id, repository_id, package_name, package_version, npm_command) on every npm handler. Prometheus metrics: npm_request_duration_seconds / npm_request_total{handler, code}, npm_publish_tarball_size_bytes; catalogs the buffered + rebuild metric families. metrics.md documents cardinality budgets. No jobsriver workers (async stays interim goroutines).

Acceptance: logging fields present on success + error paths across every handler; every metric registered exactly once; the handler enum covers every S11 route; the code enum covers every error code + success. Files: logctx.go, metrics.go, metrics.md + tests. Depends on: Steps 9, 10, 11, 16, 17, 19, 20, 21.

Plan: Step 22. Spec: docs/specs/S11-npm-local.md.