supabase-observability

No clear malicious behavior, credential theft, exfiltration, persistence, command execution, or destructive activity is present. The code is ordinary monitoring infrastructure, but the metrics and health endpoints should be authenticated or otherwise restricted because they use a service-role key and expose operational data. Raw database error details should be removed from public responses, and storage counting should be corrected if complete counts are required.