[vMCP] Add observability for session lifecycle (Phase 4)

Depends on #3872

Add comprehensive telemetry for the new session lifecycle to support performance validation, debugging, and operational monitoring.

Audit logs: emit a session_created event per session containing session ID, count of successfully initialized backends, count of failed backends, and the map of backend session IDs.

Metrics:

• vmcp_session_backend_init_duration_seconds — histogram by backend
• vmcp_session_backend_init_success_total — counter by backend
• vmcp_session_backend_init_failure_total — counter by backend with reason label
• vmcp_session_tool_call_duration_seconds — histogram (demonstrates latency improvement)
• vmcp_active_sessions — gauge tracking current number of active vMCP sessions
• vmcp_backend_connections_total — counter of total backend connections opened
• vmcp_sessions_rejected_total — counter of sessions rejected (e.g. due to limit enforcement), with reason label

Traces: distributed trace spanning session creation through first tool call.

Files: pkg/vmcp/session/default_session.go, pkg/vmcp/session/factory.go

Acceptance Criteria

• session_created audit log event is emitted on every session creation with session ID, backend counts, and backend session ID map
• All seven metrics are emitted with correct labels
• vmcp_active_sessions reflects the real-time count of active sessions and decrements on session termination or expiry
• vmcp_sessions_rejected_total is incremented whenever a session is rejected, with a reason label (e.g. global_limit, per_client_limit)
• Distributed traces span from session creation through the first tool call
• No credentials or sensitive data appear in logs, metrics, or traces
• Tests verify audit log fields, metric emission, and trace presence

RFC: THV-0038 — Session-scoped client lifecycle

Start with the linked THV-0038 RFC, then inspect pkg/vmcp/session/default_session.go and pkg/vmcp/session/factory.go to understand the session lifecycle and instrumentation points. Done means all seven metrics, the session_created audit event, lifecycle-spanning trace, sensitive-data safeguards, and tests for logs, metrics, and traces satisfy the acceptance criteria.