otel P3: auto-instrument handlers at the make-app seam

otel/instrument-routes wraps each flattened Dream route's handler in a timed
span named METHOD /route with {:http.method :http.route :http.status} attrs;
host/make-app applies it so every matched request becomes a trace. Refactored
with-span onto a shared otel/-timed core that takes a finalize fn for
result-derived attrs (the http.status only known post-handler).

lib/host/router.sx

@@ -17,9 +17,14 @@
 ;; needed. The WHOLE app is wrapped in the signed-session middleware so every
 ;; request carries a session and any handler can log a principal in/out — this is
 ;; the front door, so sessions are not optional.
+;; Every route's handler is wrapped by otel/instrument-routes (lib/host/otel.sx)
+;; so each matched request records a "METHOD /route" trace span — observability is
+;; on by default at the front door. (Resolved at call time; otel loads before any
+;; request is served.)
 (define host/make-app
   (fn (groups)
     (let ((router (dream-router
-                    (cons host/health-route
-                      (cons host/auth-routes groups)))))
+                    (otel/instrument-routes
+                      (cons host/health-route
+                        (cons host/auth-routes groups))))))
       ((host/sessions) router))))