feat(PROJ-40,PROJ-41): Prometheus Metriken + Dashboard Zeitreihe

- PROJ-40: /api/health mit Version+Uptime, /metrics Prometheus-Format
  (mails_last_60min/24h/7d/30d, mails_total, storage_bytes, tenants_total,
   users_total, uptime_seconds) — Token-Schutz optional konfigurierbar
- PROJ-41: GET /api/admin/stats/timeseries (30-Tage tagesgenau, Tenant-scoped)
  + SVG-Balkendiagramm im Dashboard (Mail-Eingang letzte 30 Tage)
- storage.DBQueryRow() Helper für Metrics-Queries ohne Pool-Exposition
- config.MetricsConfig (enabled, token) in config.go

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

config/config.go

@@ -19,6 +19,12 @@ type APIConfig struct {
 	TrustedProxies  []string `yaml:"trusted_proxies"`
 }
 
+// MetricsConfig holds settings for the Prometheus /metrics endpoint.
+type MetricsConfig struct {
+	Enabled bool   `yaml:"enabled"` // default: false
+	Token   string `yaml:"token"`   // optional Bearer token to protect /metrics
+}
+
 // Config is the full application configuration loaded from YAML.
 type Config struct {
 	Server     ServerConfig     `yaml:"server"`
@@ -31,6 +37,7 @@ type Config struct {
 	Audit      AuditConfig      `yaml:"audit"`
 	Logging    LoggingConfig    `yaml:"logging"`
 	IMAPServer IMAPServerConfig `yaml:"imap_server"`
+	Metrics    MetricsConfig    `yaml:"metrics"`
 }
 
 // IMAPServerConfig holds settings for the embedded read-only IMAP archive server.