feat(api): add device identity guard and Prometheus metrics

- Persist device identity observations and expose fleet identity summaries.

- Block device control actions when identity verification fails.

- Add metrics collection and a Prometheus scrape endpoint.

apps/api/src/infrastructure/database/database.test.ts

@@ -66,6 +66,7 @@ describe('database migrations', () => {
       'console_auth_config',
       'console_auth_sessions',
       'device_groups',
+      'device_identities',
       'event_journal',
       'instance_tags',
       'instances',