perf(api): bound worker pools and add telemetry

Share one configured PostgreSQL pool across worker repositories and make API and worker connection budgets explicit.

Add privacy-safe aggregate request, query, pool, sync, and outbox telemetry, a loopback-only representative load fixture, bounded worker shutdown, and focused regression and integration coverage.

Document the database-wide budget formula and defer pg_stat_statements activation to a reviewed migration and planned restart.

infra/backend/.env.production.example

@@ -4,6 +4,13 @@ POSTGRES_USER=sauci
 POSTGRES_PASSWORD=generate-a-long-random-password
 DATABASE_URL=postgresql://sauci:URL_ENCODED_PASSWORD@postgres:5432/sauci
 
+# Keep this total below PostgreSQL max_connections:
+# (API replicas * API_DATABASE_POOL_MAX) + (worker replicas * WORKER_DATABASE_POOL_MAX) + migration/admin headroom.
+API_DATABASE_POOL_MAX=10
+WORKER_DATABASE_POOL_MAX=4
+DATABASE_POOL_IDLE_TIMEOUT_MS=30000
+DATABASE_POOL_CONNECTION_TIMEOUT_MS=10000
+
 # Hosted Supabase Auth only. The service-role key is used solely by the
 # server-side Auth Admin endpoint for account deletion and admin identity
 # enrichment. It belongs on the API only, never the worker, MCP, or a client.