[Epic] Metrics & Traffic Observability across Resources

## Goal

Add consistent, scoped metrics visualizations across all Kuadrant-managed resources using embedded [Perses](https://perses.dev/) panels and Prometheus. The views tell a top-down diagnostic story: namespace-wide health overview → per-gateway performance → per-route traffic → per-policy decisions → consumer-facing API traffic.

## Context

Metrics support originally referenced the OpenShift Console QueryBrowser component. This epic has been redesigned to use Perses — a CNCF sandbox project that Red Hat already uses in OpenShift for observability. Perses provides embeddable React panels (TimeSeriesChart, StatChart, GaugeChart) with native Prometheus/PromQL support.

**Dependencies:** Requires React 18 upgrade (#637, OCP 4.22+) and shared Perses infrastructure established in #220.

## Available Metrics

| Source | Metrics | What They Cover |
|--------|---------|----------------|
| **Istio/Envoy** | `istio_requests_total`, `istio_request_duration_milliseconds` | Traffic rate, latency, error rate |
| **Limitador** | `authorized_calls`, `authorized_hits`, `limited_calls`, `report_calls` | Rate limiting and token rate limiting decisions |
| **Authorino** | `auth_server_authconfig_total`, `auth_server_authconfig_response_status`, `auth_server_authconfig_duration_seconds` | Auth decisions, latency |
| **Kuadrant Operator** | `kuadrant_policies_total`, `kuadrant_policies_enforced`, `kuadrant_ready`, `kuadrant_component_ready`, `kuadrant_dns_policy_ready` | Policy enforcement, operator health, DNS policy status |
| **DNS Operator** | `dns_provider_record_ready`, `dns_provider_write_counter`, `dns_health_probe_counter`, `http_client_requests_total` | DNS record health, provider operations |
| **cert-manager** | `certmanager_certificate_ready_status`, `certmanager_certificate_expiration_timestamp_seconds`, `certmanager_certificate_renewal_timestamp_seconds` | Certificate lifecycle |
| **Gateway API State Metrics** | `gatewayapi_httproute_labels` | Join key for route-to-service mapping |

## Observability Narrative

1. **Overview → Observability tab** — eagle-eye view, namespace-scoped: is something wrong?
2. **Gateway → Metrics tab** — which gateway, what kind of problem?
3. **Gateway → Backends tab** — which backend behind this gateway is slow or erroring?
4. **HTTPRoute → Metrics tab** — which route, and why? Auth denials? Backend errors?
5. **AuthPolicy → Metrics tab** — is this auth policy rejecting requests?
6. **RateLimitPolicy → Metrics tab** — are consumers hitting this rate limit?
7. **TokenRateLimitPolicy → Metrics tab** — are consumers hitting token limits?
8. **OIDCPolicy → Metrics tab** — are OIDC auth flows succeeding?
9. **DNSPolicy → Metrics tab** — are DNS records healthy?
10. **TLSPolicy → Metrics tab** — are certificates valid and renewals on track?
11. **PlanPolicy → Metrics tab** — which tiers are hitting limits?
12. **APIProduct → Traffic tab** — same story from the consumer's perspective

## Dependency Order

```
#220 Overview (establishes Perses foundation)
├─ #528 Gateway Metrics tab
├─ #533 HTTPRoute Metrics tab
├─ #536 APIProduct Traffic tab
├─ #638 AuthPolicy Metrics tab
├─ #639 RateLimitPolicy Metrics tab
├─ #640 GRPCRoute Metrics tab
├─ #683 DNSPolicy Metrics tab
├─ #684 TLSPolicy Metrics tab
├─ #685 TokenRateLimitPolicy Metrics tab
├─ #686 OIDCPolicy Metrics tab
├─ #687 PlanPolicy Metrics tab
└─ #222 Gateway Backends page
└─ #514 Backend metrics
```

## Closed/Superseded
- ~~#306 — Make Prometheus metric name suffix configurable~~ ✅ Fixed

## Notes
- All panels must handle empty states: Prometheus unavailable, no data for resource, loading
- Perses + ECharts add significant bundle size — lazy-load metrics tabs
- Limitador per-policy metric scoping requires the `-l` flag and mapping between RateLimitPolicy names and Limitador internal limit names needs investigation
- AuthConfig naming convention (AuthPolicy name → Authorino AuthConfig name) needs verification
- Token rate limiting uses `authorized_hits` and `report_calls` metrics (distinct from counter-based `authorized_calls`)
- OIDCPolicy creates two AuthConfigs per policy (main + callback) — metrics queries need to match both
- PlanPolicy per-tier breakdown requires Limitador `telemetry: exhaustive` mode
- Extension policies (PlanPolicy, OIDCPolicy) are not tracked by `kuadrant_policies_total`/`kuadrant_policies_enforced`

Start with shared Perses infrastructure in #220 and review the dependency issues listed for the planned metrics and traffic tabs. Trace the available Prometheus metrics and resource-scoping requirements, including empty states and lazy loading. Done means the planned resource views provide the diagnostic story with usable panels and handle unavailable or missing data.

Written by the indexing model from the issue text.