After refinement-phase-9 — Observability, ops hardening, docs honesty & scale-later

For the frontend / next backend phase. Backend-owned; frontend reads.

What changed for a client

Nothing user-facing. No route, envelope, shape, or enum changed. Two things worth knowing:

ApiResult.requestId is now a real W3C trace id (the request's OpenTelemetry trace). It's the id to quote in a support ticket — it maps 1:1 to the server-side trace once an OTLP collector is wired.
Ticket message bodies are encrypted at rest server-side. The thread read still returns plaintext (the wire is unchanged); the change is purely storage-side (the refund/dispute paper trail is no longer plaintext in the DB).

One OpenTelemetry stack. Metrics scrape at /metrics; distributed tracing (ASP.NET Core + EF Core) is wired. OTLP export is opt-in — set OpenTelemetry:Otlp:Endpoint (Grafana Tempo / Jaeger / OTEL Collector) to turn trace + metric export on. Prometheus-scrape-only is an acceptable MVP; prometheus-net was removed.
Health endpoints: /healthz/live (process only — safe liveness), /healthz/ready (app DB + log DB [deployed]
- an object-storage write probe — pull an instance out of rotation when a dependency is down), /HealthCheck (aggregate, kept for compat). Point the orchestrator's liveness probe at /healthz/live, readiness at /healthz/ready.
Prod logs are Information+ with no PII/secrets. The OTP code is no longer logged in any environment. Log-table retention on Baya_Logs is an ops/DBA task (or ship logs to the OTLP collector).
Audit-log retention runs as a scheduled IRecurringJob — two-tier (financial/verification rows kept ~7 yr, everyday rows ~2 yr) via the audit_retention_* config keys.
gRPC reflection is Development-only (the plugin itself is unchanged; it shares the mixed-protocol listener).

Turn tracing on in deployed envs by provisioning an OTLP collector and setting OpenTelemetry:Otlp:Endpoint.
When Redis lands (>1 instance), add a redis readiness check (tagged ready) to ConfigureHealthChecks.
Register any new retention/cron via IRecurringJob (unchanged from phase 7).

Elasticsearch INurseSearch backend + outbox feeder — pull when SQL search shows strain. SQL search is the real MVP (Search:Backend=sql; any other value fails fast).
SMS/push channels of INotificationDispatcher — pull when the notification UX demands out-of-app reach. In-app notifications are real now.
Analytics warehouse/stream, holiday-calendar feed, 8 deferred product tables (organizations, organization_nurses, fraud_flags, recurring_booking_schedules, bnpl_settlement_entries, availability slots, customer national-ID KYC, geo bulk import) — each a pure additive step when product pulls it.