Summary

Add OpenTelemetry metrics instrumentation to the issuer (apigw) and verifier services, covering the full OpenID4VCI and OpenID4VP flows.

Motivation

We currently have OTel tracing (spans) but zero metrics exported. For production observability, we need counters and histograms covering:

• Credential offer creation rates
• Token issuance rates and latency
• Credential issuance rates and latency (by format)
• Credential issuance failures (by error class)
• Verifiable presentation reception and verification latency

PII Safety

All metric labels are restricted to protocol-level metadata (format, grant_type, credential_config_id, source, error_class). No subject identifiers, personal numbers, session IDs, or claim values are ever recorded.

Proposed Metrics

VCI (Issuer)

• vci.offers.created — counter {grant_type, credential_config_id, source}
• vci.tokens.issued — counter {grant_type}
• vci.credentials.issued — counter {format, credential_config_id}
• vci.credentials.failed — counter {format, error_class}
• vci.deferred.credentials — counter {status}
• vci.notifications — counter {event}
• vci.token.duration — histogram {grant_type}
• vci.credential.duration — histogram {format}

VP (Verifier)

• vp.requests.created — counter
• vp.presentations.received — counter
• vp.verifications.failed — counter {error_class}
• vp.verification.duration — histogram

Configuration

Controlled via common.metrics config block (mirrors common.tracing):

common:
  metrics:
    enable: true
    addr: "collector:4318"

Exposes /metrics Prometheus scrape endpoint on the apigw HTTP server.