RequestTimer double-counts requests; no error-rate or saturation metrics

Severity: high (bug + missing coverage).

### Summary

Two related observability defects.

**a) Duration histograms are double-counted and the only error signal is meaningless.** `RequestTimer::finish(&self, …)` takes `&self` and sets no completed flag (`crates/node/src/metrics.rs:278`), and `Drop` unconditionally calls `self.finish("dropped")` (`crates/node/src/metrics.rs:293-297`). Every success path calls `finish("ok")` and *then* the drop records the same duration again with `status="dropped"`. Result: sample counts are 2x inflated and `status="dropped"` fires on every successful request, so error rate and latency percentiles are wrong.

**b) No metrics an operator would alert on.** `crates/node/src/metrics.rs` defines only per-RPC counters/histograms. Missing: gRPC error counter by status code, active `stream_notes` subscription count, total note count, DB file size, connection-pool utilization, maintenance last-success heartbeat, process build-info/uptime.

### Recommendation

- Make `finish(self, …)` consume the timer (or guard `Drop` with a `finished: bool`) and record error paths with a real `status="error"`.
- Add an error counter with a `code` label (ideally a tower/tonic interceptor so it covers all RPCs), plus observable gauges for subscriptions, note count, DB size, pool state, and a maintenance heartbeat.

---
Part of #114.

Le bogue se trouve dans crates/node/src/metrics.rs autour des lignes 278 et 293-297. Commencez par examiner la structure RequestTimer et ses implémentations finish et Drop. Pour vérifier la correction, exécutez les tests existants pour les métriques. L'ajout de nouvelles métriques nécessite de comprendre la configuration gRPC et la structure de la base de code pour les compteurs et les jauges.

Rédigé par le modèle d'indexation à partir du texte de l'issue.