feat(maven): count the version-cap rejection and upload size

Summary

Completes the third item of this follow-up: the two domain series the Maven hosted upload path was missing, beside the RED coverage the HTTP middleware already gives it.

• gitlab_artifact_registry_maven_version_limit_exceeded_total counts the 422 version_limit_exceeded refusals the per-package version cap issues, so a package refusing new versions is visible without reading problem envelopes out of logs.
• gitlab_artifact_registry_maven_upload_size_bytes observes the committed byte size on a commit that wrote or rewrote the maven_files row, so the upload size distribution is readable per file.

docs/dev/observability.md gains a row per series, and upload_commit.md records why the observation sits on the commit arm beside the storage-accounting emit.

Items 1 and 2 of the issue already landed on main in !765 (merged) (S10 Step 8b): the cap with Config threaded into maven.Deps (upload_version_cap_test.go, upload_limits_test.go, TestBuildMavenDispatcher_DepsLiteralCarriesEverySeam), and the commit path reusing the pre-stream rows through FindOrCreateVersion plus the upsert (TestUpload_VersionCap_ExistingVersionAdmittedAtCap, TestUpload_PackageMetadata_201Then200).

Governing ADRs

ADR-004 (data and application limits) relates: the counter measures refusals of the Maven per-package version cap, and the histogram measures Maven artifact size against ADR-004's 5 GB ceiling for the format. No deviation and no amendment MR. No other ADR governs a change that adds two metric series; ./scripts/adr-freshness.sh reports one upstream commit not yet synced, on ADR-020 (auth flow), which this MR does not touch.

Testing

• go test ./internal/format/maven/ — unit suite green, including the cardinality audit and TestRegisterMetrics_ExposedViaGatherer, whose expected-name list must equal mavenCollectors.
• go test -tags integration -run 'TestUpload_(VersionCap_NewVersionRejected|VersionCap_ExistingVersionAdmittedAtCap|FreshRelease_201|ReleaseIdenticalContent_200)$' ./internal/format/maven/ — green against testcontainers Postgres (100s). The two arms each metric's own doc says it does not count are pinned: an admitted-at-cap upload books no cap refusal, and a byte-identical release re-upload books no size observation.
• golangci-lint run clean on the package, and clean on the touched files with --build-tags=integration --max-same-issues=0 --max-issues-per-linter=0 --uniq-by-line=false.

Spec coverage

No S10 acceptance criterion or error case covers these series: S10's ACs are protocol behavior and this MR changes none. The coverage source is the issue's third item, pinned by the tests above and catalogued in docs/dev/observability.md.

Guardrails

• e2e scenarios: no protocol behavior changes, so no docs/testing/ scenario is added or affected.
• docs/user/: not customer-visible — metrics only.
• Conformance: not applicable, no Maven protocol behavior changed.
• Reviewable LOC: ~75, no size justification needed.

Related to #232 (closed)