feat(metrics): record eventsourced pg outbox publishes and retries (#182)

## Why
authz-service now publishes through pg/v2's transactional outbox, and nothing measured it: `NewEventsourcedMetrics` ignored the `pg.Outbox*` metrics. Without them a failing or abandoned publish (a lost privilege revocation for running authz_clients) can't be alerted on.

## What
- `pg.OutboxPublish` → histogram `eventsourced.outbox.publish.duration` (`event.type`, `success`)
- `pg.OutboxRetry` → counter `eventsourced.outbox.retries` (`event.type`, `permanent`)
- `pg.OutboxBatch` / `pg.OutboxCleanup` stay ignored.

otelsetup now imports `codeberg.org/eventsourced/pg/v2` v2.1.1 (`go` directive becomes 1.26.0; grpc patch bump via MVS). All current consumers already depend on pg/v2; a release raises their minimum to v2.1.1.

## Tests
`go test -race ./...` green; the contract test records both new metrics.

## Review
Go Backend expert reviewed: no Critical/High. Noted: the test checks instrument names only, not attributes; the pg/v2 dependency is worth a line in the release notes.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_013DJouG8ZZZxKtodF9kDvzj
Reviewed-on: https://gitea.unbound.se/shiny/otelsetup/pulls/182

metrics_test.go

@@ -7,6 +7,7 @@ import (
 	"time"
 
 	"codeberg.org/eventsourced/eventsourced"
+	"codeberg.org/eventsourced/pg/v2"
 	"go.opentelemetry.io/otel"
 	sdkmetric "go.opentelemetry.io/otel/sdk/metric"
 	"go.opentelemetry.io/otel/sdk/metric/metricdata"
@@ -33,6 +34,8 @@ func TestNewEventsourcedMetrics_RecordsContract(t *testing.T) {
 		eventsourced.SnapshotStored{AggregateType: "Entry", Duration: time.Millisecond, Success: true},
 		eventsourced.SnapshotLoaded{AggregateType: "Entry", Found: false, Duration: time.Millisecond},
 		eventsourced.IdempotencyCheck{AggregateType: "Entry", Hit: true},
+		pg.OutboxPublish{EventType: "EntryAdded", Success: false, Duration: time.Millisecond},
+		pg.OutboxRetry{EventType: "EntryAdded", RetryCount: 1},
 		unknownMetric{},
 	} {
 		r.Record(context.Background(), m)
@@ -57,6 +60,8 @@ func TestNewEventsourcedMetrics_RecordsContract(t *testing.T) {
 		"eventsourced.snapshot.store.duration",
 		"eventsourced.snapshot.load.duration",
 		"eventsourced.idempotency.checks",
+		"eventsourced.outbox.publish.duration",
+		"eventsourced.outbox.retries",
 	}
 	var missing []string
 	for _, w := range want {