Align observability with OpenTelemetry conventions and isolate telemetry failures

Problem

This package combines custom request middleware and metrics with OpenTelemetry's HTTP instrumentation. The overlapping paths make request telemetry harder to reason about, can produce duplicate or inconsistent measurements, and leave application availability dependent on instrumentation behavior. In #18, an incompatibility in OpenTelemetry's FastAPI instrumentation caused CORS preflight requests in PolicyEngine/policyengine-uk-chat#167 to return 500; catching errors only when instrumentation is installed did not protect requests afterward.

Proposed work

• Inventory the package's HTTP request spans, metrics, logging, outbound HTTP instrumentation, exporters, and their consumers. Decide which functionality belongs in standard OpenTelemetry instrumentation and which PolicyEngine-specific measurements still need custom code. Avoid duplicate request instrumentation and align retained metrics and attributes with OpenTelemetry conventions.
• Simplify the package around standard OpenTelemetry APIs and supported framework integrations. Preserve useful application-specific logging and timing without duplicating generic HTTP telemetry; make the enabled integrations and dependency compatibility explicit.
• Ensure recoverable telemetry failures during setup, request processing, export, and shutdown cannot turn an otherwise successful application operation into a failure. Do not suppress exceptions raised by the application itself or run a request a second time. Address the active-request metric's mismatched increment/decrement attributes as part of the redesign.
• Add tests for successful and failing application requests when telemetry fails, plus relevant FastAPI (including CORS), Flask, outbound HTTP, streaming, and shutdown behavior. Verify the resulting metrics and spans are not duplicated and document any changes that consumers need to make.

Outcome

Services retain useful request and application telemetry through a simpler, conventional OpenTelemetry integration, while a telemetry defect cannot by itself make an otherwise healthy service fail.

Related: #18, #27, PolicyEngine/policyengine-uk-chat#167.

Start with related issue #18, then inventory the package's HTTP middleware, metrics, logging, outbound HTTP instrumentation, exporters, and consumers. Map the FastAPI, Flask, CORS, streaming, and shutdown paths before deciding what belongs in standard OpenTelemetry integrations. Done means telemetry is not duplicated, recoverable telemetry failures do not fail application requests, and the requested behaviors are covered by tests and documentation.