perf(api): bound worker pools and add telemetry

Share one configured PostgreSQL pool across worker repositories and make API and worker connection budgets explicit.

Add privacy-safe aggregate request, query, pool, sync, and outbox telemetry, a loopback-only representative load fixture, bounded worker shutdown, and focused regression and integration coverage.

Document the database-wide budget formula and defer pg_stat_statements activation to a reviewed migration and planned restart.

apps/api/.env.example

@@ -5,8 +5,9 @@ SUPABASE_AUTH_AUDIENCE=authenticated
 
 # Optional connection-pool bounds. The API process opens one pool and shares it
 # across every repository, so these are the process-wide limits, not per-domain
-# ones. Raising DATABASE_POOL_MAX raises the server connections this instance can
-# hold; keep the total across instances inside the database's own limit.
+# ones. The worker has its own separately bounded process pool. Raising either
+# maximum raises the server connections this instance can hold; keep the total
+# across instances inside the database's own limit.
 # DATABASE_POOL_MAX=10
 # DATABASE_POOL_IDLE_TIMEOUT_MS=30000
 # DATABASE_POOL_CONNECTION_TIMEOUT_MS=10000