feat: Observabilité et monitoring complet

Implémentation complète de la stack d'observabilité pour le monitoring
de la plateforme multi-tenant Classeo.

## Error Tracking (GlitchTip)
- Intégration Sentry SDK avec GlitchTip auto-hébergé
- Scrubber PII avant envoi (RGPD: emails, tokens JWT, NIR français)
- Contexte enrichi: tenant_id, user_id, correlation_id
- Configuration backend (sentry.yaml) et frontend (sentry.ts)

## Metrics (Prometheus)
- Endpoint /metrics avec restriction IP en production
- Métriques HTTP: requests_total, request_duration_seconds (histogramme)
- Métriques sécurité: login_failures_total par tenant
- Métriques santé: health_check_status (postgres, redis, rabbitmq)
- Storage Redis pour persistance entre requêtes

## Logs (Loki)
- Processors Monolog: CorrelationIdLogProcessor, PiiScrubberLogProcessor
- Détection PII: emails, téléphones FR, tokens JWT, NIR français
- Labels structurés: tenant_id, correlation_id, level

## Dashboards (Grafana)
- Dashboard principal: latence P50/P95/P99, error rate, RPS
- Dashboard par tenant: métriques isolées par sous-domaine
- Dashboard infrastructure: santé postgres/redis/rabbitmq
- Datasources avec UIDs fixes pour portabilité

## Alertes (Alertmanager)
- HighApiLatencyP95/P99: SLA monitoring (200ms/500ms)
- HighErrorRate: error rate > 1% pendant 2 min
- ExcessiveLoginFailures: détection brute force
- ApplicationUnhealthy: health check failures

## Infrastructure
- InfrastructureHealthChecker: service partagé (DRY)
- HealthCheckController: endpoint /health pour load balancers
- Pre-push hook: make ci && make e2e avant push

backend/config/bundles.php

@@ -14,4 +14,5 @@ return [
     Symfony\Bundle\MakerBundle\MakerBundle::class => ['dev' => true],
     Doctrine\Bundle\FixturesBundle\DoctrineFixturesBundle::class => ['dev' => true, 'test' => true],
     Nelmio\CorsBundle\NelmioCorsBundle::class => ['all' => true],
+    Sentry\SentryBundle\SentryBundle::class => ['all' => true],
 ];

backend/config/packages/security.yaml

@@ -16,6 +16,11 @@ security:
         dev:
             pattern: ^/(_(profiler|wdt)|css|images|js)/
             security: false
+        # Monitoring endpoints - no authentication, restricted by IP in production
+        monitoring:
+            pattern: ^/(health|metrics)$
+            stateless: true
+            security: false
         api_login:
             pattern: ^/api/login$
             stateless: true

backend/config/packages/sentry.yaml

@@ -0,0 +1,24 @@
+# Sentry/GlitchTip Configuration
+# Error tracking with automatic context enrichment
+#
+# To enable error tracking:
+# 1. Set up GlitchTip at http://localhost:8081 (via make up-full)
+# 2. Create a project and get the DSN
+# 3. Add SENTRY_DSN to .env.local
+
+sentry:
+    dsn: '%env(default::SENTRY_DSN)%'
+    register_error_handler: false  # Disable when DSN is empty
+    options:
+        environment: '%env(SENTRY_ENVIRONMENT)%'
+        send_default_pii: false  # CRITICAL: No PII in error reports (RGPD)
+
+when@prod:
+    sentry:
+        register_error_handler: true  # Enable in production
+        options:
+            before_send: 'App\Shared\Infrastructure\Monitoring\SentryBeforeSendCallback'
+
+when@test:
+    sentry:
+        dsn: ''

backend/config/services.yaml

@@ -167,6 +167,62 @@ services:
     App\Shared\Infrastructure\Captcha\TurnstileValidatorInterface:
         alias: App\Shared\Infrastructure\Captcha\TurnstileValidator
 
+    # =============================================================================
+    # Monitoring & Observability (Story 1.8)
+    # =============================================================================
+
+    # Prometheus CollectorRegistry - uses Redis for persistence between requests
+    Prometheus\Storage\Redis:
+        factory: ['App\Shared\Infrastructure\Monitoring\PrometheusStorageFactory', 'createRedisStorage']
+        arguments:
+            $redisUrl: '%env(REDIS_URL)%'
+
+    Prometheus\CollectorRegistry:
+        arguments:
+            $storageAdapter: '@Prometheus\Storage\Redis'
+
+    # Sentry/GlitchTip PII scrubber callback
+    App\Shared\Infrastructure\Monitoring\SentryBeforeSendCallback: ~
+
+    # Infrastructure Health Checker - shared service for health checks (DRY)
+    App\Shared\Infrastructure\Monitoring\InfrastructureHealthChecker:
+        arguments:
+            $redisUrl: '%env(REDIS_URL)%'
+
+    # Interface alias for InfrastructureHealthChecker (allows testing with stubs)
+    App\Shared\Infrastructure\Monitoring\InfrastructureHealthCheckerInterface:
+        alias: App\Shared\Infrastructure\Monitoring\InfrastructureHealthChecker
+
+    # Health Check Controller - uses shared InfrastructureHealthChecker
+    App\Shared\Infrastructure\Monitoring\HealthCheckController: ~
+
+    # Metrics Controller - restricted to internal networks in production
+    App\Shared\Infrastructure\Monitoring\MetricsController:
+        arguments:
+            $appEnv: '%kernel.environment%'
+
+    # Health Metrics Collector - exposes health_check_status gauge
+    App\Shared\Infrastructure\Monitoring\HealthMetricsCollector: ~
+
+    # Interface alias for HealthMetricsCollector (allows testing with stubs)
+    App\Shared\Infrastructure\Monitoring\HealthMetricsCollectorInterface:
+        alias: App\Shared\Infrastructure\Monitoring\HealthMetricsCollector
+
+    # Sentry context enricher - adds tenant/user/correlation_id to error reports
+    # Explicitly registered to ensure HubInterface dependency is resolved
+    App\Shared\Infrastructure\Monitoring\SentryContextEnricher:
+        arguments:
+            $sentryHub: '@Sentry\State\HubInterface'
+
+    # Monolog processors for structured logging
+    App\Shared\Infrastructure\Monitoring\CorrelationIdLogProcessor:
+        tags:
+            - { name: monolog.processor }
+
+    App\Shared\Infrastructure\Monitoring\PiiScrubberLogProcessor:
+        tags:
+            - { name: monolog.processor }
+
 # =============================================================================
 # Test environment overrides
 # =============================================================================