Add Prometheus metrics for connections, firewall, L7, and bytes transferred

Instrument mc-proxy with prometheus/client_golang. New internal/metrics/
package defines counters, gauges, and histograms for connection totals,
active connections, firewall blocks by reason, backend dial latency,
bytes transferred, L7 HTTP status codes, and L7 policy blocks. Optional
[metrics] config section starts a scrape endpoint. Firewall gains
BlockedWithReason() to report block cause. L7 handler wraps
ResponseWriter to record status codes per hostname.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/config/config.go

@@ -22,9 +22,16 @@ type Config struct {
 	GRPC      GRPC       `toml:"grpc"`
 	Firewall  Firewall   `toml:"firewall"`
 	Proxy     Proxy      `toml:"proxy"`
+	Metrics   Metrics    `toml:"metrics"`
 	Log       Log        `toml:"log"`
 }
 
+// Metrics holds the Prometheus metrics endpoint configuration.
+type Metrics struct {
+	Addr string `toml:"addr"` // e.g. "127.0.0.1:9090"
+	Path string `toml:"path"` // e.g. "/metrics" (default)
+}
+
 // Database holds the database configuration.
 type Database struct {
 	Path string `toml:"path"`
@@ -215,6 +222,10 @@ func (c *Config) validate() error {
 		}
 	}
 
+	if c.Metrics.Addr != "" && c.Metrics.Path != "" && !strings.HasPrefix(c.Metrics.Path, "/") {
+		return fmt.Errorf("metrics.path must start with \"/\"")
+	}
+
 	if c.Proxy.ConnectTimeout.Duration < 0 {
 		return fmt.Errorf("proxy.connect_timeout must not be negative")
 	}