Record metrics and charge for HTTP route egress

[bradleyshep]

Description of Changes

The HTTP /sql endpoint charged for its DB work (rows/bytes scanned, writes) but not for egress, the bytes sent back to the client. WebSocket queries already count these, but the HTTP path skipped it, so the same query was billed over WS and free over HTTP. There were also no metrics on the HTTP routes.

This PR:

1. Charges egress for /sql, using the BSATN size of the result rows so the price matches WebSocket queries.
2. Adds a /v1 middleware that records per-route request count, latency, and body sizes. Body sizes count bytes actually transferred through a small Body wrapper rather than trusting the Content-Length header, so chunked and streamed bodies are counted and spoofed headers are not. Non-standard HTTP methods are bucketed into an OTHER label to keep cardinality bounded.

Adds http-body as a direct dependency (already in the tree via axum/hyper).

Not covered here: CORS preflights and unmatched 404s are not counted (they short-circuit before the middleware), and routes other than /sql are not billed egress yet.

API and ABI breaking changes

None. The /sql response is unchanged, only internal metrics were added.

Expected complexity level and risk

2. The egress change is one counter increment on the existing SQL path. The middleware is router setup plus a ~35 line body wrapper.

Testing

• Unit test that a SELECT charges bytes_sent_to_clients equal to the rows' BSATN size.
• Verified locally: a SELECT over HTTP bumps the egress counter by the exact BSATN size and the spacetime_http_* counters by the exact wire bytes (checked against curl's size_download).
• Verified locally: a bogus method (curl -X BANANA) lands in the OTHER bucket, and a chunked request body (no Content-Length) is counted.
• Existing SQL smoketests pass.