M16.2 Every API stack: SDK middleware and OpenTelemetry #65

Part of #63. Needs M16.1 and the web SDK server helpers #60, #61, #62.

Every API, whatever it is written in, reports to API monitoring without per-route code.

yuva-api

• Contract and handler: POST /otlp/{propertyId}/v1/traces, OTLP/HTTP with binary protobuf and JSON by Content-Type and gzip, Bearer key with analytics:write; read with protowire, no OTLP module. SERVER spans only: http.request.method, http.route, http.response.status_code, duration, url.path for inference only, client.address for the country, body sizes when present; resource service.name, deployment.environment.name (or deployment.environment), service.version as release, service.instance.id; yuva.consumer and yuva.api_version span attributes; weight from tracestate ot=th. 200 with partial_success for invalid spans, 429/503 with Retry-After.
• POST /client/v1/analytics/{key}/requests for app-side records (up to 100, a.platform in the property's platforms, source app, no consumer, the property's collection rules).

yuva-widget (web SDK)

• createMonitor on useyuva/server (Web SDK: server helpers for identity tokens, webhooks and analytics (useyuva/server) #60) with middleware for srvx, h3 (Web SDK: h3 handlers for identity tokens, webhooks and analytics (useyuva/h3) #61), Nitro and Nuxt (Nitro module and Nuxt server integration: identity route, webhooks, analytics (useyuva/nitro) #62), Hono, Express, Fastify and Next.js route handlers; each takes the route pattern from its router and flushes through waitUntil or the server's close hook; optional sampleRate for successful requests only.

yuva-mobile

• Swift YuvaAnalytics and Kotlin yuva-analytics: optional timing of the host app's calls to its own API (URLSession and OkHttp interceptors), route from a host-supplied mapping, status, duration, app version; off until the host enables it, sent only when the app's analytics would be (consent mode and opt-out), queued offline like events.
• Privacy manifest adds NSPrivacyCollectedDataTypePerformanceData (not linked, no tracking, analytics and app functionality; check the key against Xcode's list); the Play data safety guide adds "App info and performance › Diagnostics".

yuva-docs

• One page per stack (Go, Node/Bun/Deno frameworks, OpenTelemetry for anything else with the two environment variables and "export every server span", iOS and Android client side); en, tr, de.

Done when

The same small API written for Go, h3, Nitro, Hono, Express and an OpenTelemetry-instrumented service (protobuf and JSON exporters) shows identical routes and counts; app-side records appear next to server-side ones for the same route, and a consent-mode property gets none before consent.