Expose outbox and access-decision metrics via a /metrics Prometheus endpoint

[Lakes41]

Difficulty: Intermediate
Type: DevOps

Background
The README documents specific Observability metrics (outbox_events_created_total, outbox_events_delivered_total, outbox_events_failed_total) but doesn't indicate they're exposed via a scrapeable endpoint.

Problem
Without a /metrics endpoint, these counters aren't consumable by standard monitoring stacks (Prometheus/Grafana), limiting operational visibility into outbox health and access-decision volume.

Expected outcome
A GET /metrics endpoint on the access-api exposes the existing outbox counters plus new counters for access decisions (access_decisions_total{decision="allowed"|"denied"}) in Prometheus text format.

Suggested implementation

• Add prom-client to apps/access-api.
• Register existing counters (wire them into the outbox worker where they're currently just described) and add new counters for access decisions in the policy engine call path.
• Add a /metrics route (excluded from rate limiting and versioned auth, if applicable).
• Document the endpoint and metrics list in README.md.

Acceptance criteria

• /metrics returns valid Prometheus-format output
• Existing outbox counters are actually incremented, not just described
• New access-decision counters increment correctly per decision type
• Endpoint documented in README

Likely affected files/directories

• apps/access-api/src/workers/outboxWorker.ts
• apps/access-api/src/ (new metrics route)
• README.md

[EngrEOOnoja]

I'd like to take this on. I'll add prom-client, wire the existing outbox counters into the outbox worker (currently only described, not incremented), add new access-decision counters in the policy-engine call path, expose them via a /metrics route excluded from rate limiting and auth, and document the endpoint and metrics list in the README.

[grantfox-oss]

🦊 GrantFox — @EngrEOOnoja has been assigned to this issue as part of the Official Campaign | FWC26 campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #265)
2. Your PR will be reviewed by the Adamantine-guild maintainers

Good luck! Track your progress on GrantFox.