Add session admission saturation metrics

[bill-ph]

Summary

• add org-labelled, request-level session admission wait/count metrics, process-local queue/admitted-vCPU gauges, and a config-reconciled org vCPU-limit gauge
• split scheduler evaluation metrics into decision and reason, and retire the ambiguous legacy admission family
• measure PostgreSQL and Flight session bootstrap through protocol readiness without double-counting Flight's fast/final attempts
• document metric boundaries, replica aggregation, PromQL recipes, and the old-to-new migration

Test plan

• just test-unit
• just test-controlplane
• just test-controlplane-k8s
• just test-configstore-integration
• just lint

Compatibility

The five legacy duckgres_org_connection_admission_* metrics are intentionally retired. docs/metrics.md contains the replacement mapping and notes where semantics are not numerically equivalent.

Out of scope

Pre-existing gauge cleanup behavior is unchanged: duckgres_org_sessions_active{org} can retain a removed org's last series, while duckgres_org_storage_tracked_bytes{org} and duckgres_org_storage_pending_delete_files{org} can retain last-successful samples across org removal or leader handoff. Those metrics should be reconciled separately with explicit label deletion and leader-owned reset semantics; this PR applies that lifecycle pattern only to the new admission-limit gauge.

[github-actions]

Test Impact Plan

Deterministic summary of how this PR changes tests, CI runners, and coverage-risk signals.

Summary

Area	Added	Changed	Deleted
Test files	3	6	0
E2E/journey files	0	0	0
Workflow files	0	0	0

Signals

• Test cases: +10 / -0
• Assertions: +47 / -5
• Skips or known failures added: 0
• Workflow continue-on-error added: 0
• Workflow path filters added: 0
• Test commands removed from justfile: 0
• E2E/journey retry lines added: 0

Coverage risk: neutral or increased

No coverage-reduction warnings detected.